@kaynooo/guard-tools 0.0.0-stage → 0.3.0

package/dist/cli.js

@@ -0,0 +1,2292 @@
+#!/usr/bin/env bun
+// @bun
+
+// src/cli.ts
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname } from "path";
+import process6 from "process";
+
+// ../kit/src/args.ts
+import process3 from "process";
+import { parseArgs } from "util";
+
+// ../kit/src/style.ts
+import process2 from "process";
+
+// ../../node_modules/.bun/@kaynooo+utils@2.31.0+d0769e28dc4dad16/node_modules/@kaynooo/utils/dist/chunk-mtetydvc.js
+function x(s) {
+  let r = s.startsWith("#") ? s.slice(1).toLowerCase() : s.toLowerCase();
+  if (!/^[a-f0-9]+$/.test(r))
+    return [0, 0, 0];
+  let t = r.length, n = (c) => Number.parseInt(c, 16);
+  if (t === 3 || t === 4) {
+    let c = n(r[0] + r[0]), u = n(r[1] + r[1]), h = n(r[2] + r[2]), g = t === 4 ? n(r[3] + r[3]) : undefined;
+    return g !== undefined ? [c, u, h, g] : [c, u, h];
+  }
+  if (t !== 6 && t !== 8)
+    throw Error(`Invalid hex color length: ${t}`);
+  let a = n(r.slice(0, 2)), b = n(r.slice(2, 4)), o = n(r.slice(4, 6)), y = t === 8 ? n(r.slice(6, 8)) : undefined;
+  if ([a, b, o].some(Number.isNaN) || y !== undefined && Number.isNaN(y))
+    throw Error(`Invalid hex color value: ${s}`);
+  return y !== undefined ? [a, b, o, y] : [a, b, o];
+}
+function A(s) {
+  let [r, t, n, a] = s;
+  if (a)
+    return `#${(r << 24 | t << 16 | n << 8 | Math.round((a ?? 1) * 255)).toString(16).padStart(8, "0").toUpperCase()}`;
+  return `#${(r << 16 | t << 8 | n).toString(16).padStart(6, "0").toUpperCase()}`;
+}
+function R(s, r, t) {
+  s = (s % 360 + 360) % 360, t /= 100;
+  let n = r * Math.min(t, 1 - t) / 100, a = (b) => {
+    let o = (b + s / 30) % 12, y = t - n * Math.max(Math.min(o - 3, 9 - o, 1), -1);
+    return Math.round(255 * y);
+  };
+  return [a(0), a(8), a(4)];
+}
+function k(s) {
+  let [r, t, n] = s;
+  r /= 255, t /= 255, n /= 255;
+  let a = Math.max(r, t, n), b = Math.min(r, t, n), o = 0, y = 0, c = (a + b) / 2;
+  if (a !== b) {
+    let u = a - b;
+    if (y = c > 0 && c < 1 ? u / (1 - Math.abs(2 * c - 1)) : 0, a === r)
+      o = (t - n) / u + (t < n ? 6 : 0);
+    else if (a === t)
+      o = (n - r) / u + 2;
+    else
+      o = (r - t) / u + 4;
+    o /= 6;
+  }
+  return [Math.round(o * 360), Math.round(y * 100), Math.round(c * 100)];
+}
+function H(s, r, t) {
+  s = (s % 360 + 360) % 360, r /= 100, t /= 100;
+  let n = (a) => {
+    let b = (a + s / 60) % 6, o = t - t * r * Math.max(Math.min(b, 4 - b, 1), 0);
+    return Math.round(255 * o);
+  };
+  return [n(5), n(3), n(1)];
+}
+function f(s) {
+  let [r, t, n] = s;
+  r /= 255, t /= 255, n /= 255;
+  let a = Math.max(r, t, n), b = Math.min(r, t, n), o = a - b, y = 0, c = a === 0 ? 0 : o / a, u = a;
+  if (o !== 0) {
+    if (a === r)
+      y = (t - n) / o + (t < n ? 6 : 0);
+    else if (a === t)
+      y = (n - r) / o + 2;
+    else
+      y = (r - t) / o + 4;
+    y /= 6;
+  }
+  return [Math.round(y * 360), Math.round(c * 100), Math.round(u * 100)];
+}
+function O(s) {
+  let r = s[0] / 255, t = s[1] / 255, n = s[2] / 255, a = 1 - Math.max(r, t, n);
+  if (a === 1)
+    return [0, 0, 0, 100];
+  let b = (1 - r - a) / (1 - a), o = (1 - t - a) / (1 - a), y = (1 - n - a) / (1 - a);
+  return [Math.round(b * 100), Math.round(o * 100), Math.round(y * 100), Math.round(a * 100)];
+}
+function v(s, r, t, n) {
+  return s /= 100, r /= 100, t /= 100, n /= 100, [Math.round(255 * (1 - s) * (1 - n)), Math.round(255 * (1 - r) * (1 - n)), Math.round(255 * (1 - t) * (1 - n))];
+}
+var m = (s) => s <= 0.04045 ? s / 12.92 : ((s + 0.055) / 1.055) ** 2.4;
+var p = (s) => s <= 0.0031308 ? 12.92 * s : 1.055 * s ** 0.4166666666666667 - 0.055;
+var i = (s, r) => Math.round(s * 10 ** r) / 10 ** r;
+function T(s) {
+  let r = m(s[0] / 255), t = m(s[1] / 255), n = m(s[2] / 255), a = Math.cbrt(0.4122214708 * r + 0.5363325363 * t + 0.0514459929 * n), b = Math.cbrt(0.2119034982 * r + 0.6806995451 * t + 0.1073969566 * n), o = Math.cbrt(0.0883024619 * r + 0.2817188376 * t + 0.6299787005 * n);
+  return [i(0.2104542553 * a + 0.793617785 * b - 0.0040720468 * o, 4), i(1.9779984951 * a - 2.428592205 * b + 0.4505937099 * o, 4), i(0.0259040371 * a + 0.7827717662 * b - 0.808675766 * o, 4)];
+}
+function M(s, r, t) {
+  let n = (s + 0.3963377774 * r + 0.2158037573 * t) ** 3, a = (s - 0.1055613458 * r - 0.0638541728 * t) ** 3, b = (s - 0.0894841775 * r - 1.291485548 * t) ** 3, o = p(4.0767416621 * n - 3.3077115913 * a + 0.2309699292 * b), y = p(-1.2684380046 * n + 2.6097574011 * a - 0.3413193965 * b), c = p(-0.0041960863 * n - 0.7034186147 * a + 1.707614701 * b), u = (h) => Math.min(255, Math.max(0, Math.round(h * 255)));
+  return [u(o), u(y), u(c)];
+}
+function d(s) {
+  let [r, t, n] = T(s), a = Math.sqrt(t * t + n * n), b = (Math.atan2(n, t) * 180 / Math.PI + 360) % 360;
+  return [i(r, 4), i(a, 4), i(b, 2)];
+}
+function C(s, r, t) {
+  let n = t * Math.PI / 180;
+  return M(s, r * Math.cos(n), r * Math.sin(n));
+}
+function l(s) {
+  let r = s / 255;
+  return r <= 0.03928 ? r / 12.92 : ((r + 0.055) / 1.055) ** 2.4;
+}
+
+class e {
+  r;
+  g;
+  b;
+  a;
+  constructor(s, r, t, n = 1) {
+    this.r = s, this.g = r, this.b = t, this.a = n;
+  }
+  static from(s, r) {
+    if (s === "hex") {
+      let [t, n, a, b] = x(r);
+      return new e(t, n, a, b);
+    }
+    if (s === "rgb") {
+      if (Array.isArray(r)) {
+        let [o, y, c, u] = r;
+        return new e(o, y, c, u);
+      }
+      let { r: t, g: n, b: a, a: b } = r;
+      return new e(t, n, a, b);
+    }
+    if (s === "hsl") {
+      let t, n, a, b;
+      if (Array.isArray(r))
+        [t, n, a, b] = r;
+      else
+        ({ h: t, s: n, l: a, a: b } = r);
+      let [o, y, c] = R(t, n, a);
+      return new e(o, y, c, b);
+    }
+    if (s === "hsv") {
+      let t, n, a, b;
+      if (Array.isArray(r))
+        [t, n, a, b] = r;
+      else
+        ({ h: t, s: n, v: a, a: b } = r);
+      let [o, y, c] = H(t, n, a);
+      return new e(o, y, c, b);
+    }
+    if (s === "cmyk") {
+      let t, n, a, b, o;
+      if (Array.isArray(r))
+        [t, n, a, b, o] = r;
+      else
+        ({ c: t, m: n, y: a, k: b, a: o } = r);
+      let [y, c, u] = v(t, n, a, b);
+      return new e(y, c, u, o);
+    }
+    if (s === "oklch") {
+      let t, n, a, b;
+      if (Array.isArray(r))
+        [t, n, a, b] = r;
+      else
+        ({ l: t, c: n, h: a, a: b } = r);
+      let [o, y, c] = C(t, n, a);
+      return new e(o, y, c, b);
+    }
+    if (s === "oklab") {
+      let t, n, a, b;
+      if (Array.isArray(r))
+        [t, n, a, b] = r;
+      else
+        ({ l: t, a: n, b: a, alpha: b } = r);
+      let [o, y, c] = M(t, n, a);
+      return new e(o, y, c, b);
+    }
+    throw Error("Invalid input");
+  }
+  to(s) {
+    switch (s) {
+      case "rgb":
+        return [this.r, this.g, this.b];
+      case "rgba":
+        return [this.r, this.g, this.b, this.a];
+      case "hex":
+        return A([this.r, this.g, this.b]);
+      case "hexa":
+        return A([this.r, this.g, this.b, this.a]);
+      case "hsl":
+        return k([this.r, this.g, this.b]);
+      case "hsla":
+        return [...k([this.r, this.g, this.b]), this.a];
+      case "hsv":
+        return f([this.r, this.g, this.b]);
+      case "hsva":
+        return [...f([this.r, this.g, this.b]), this.a];
+      case "cmyk":
+        return O([this.r, this.g, this.b]);
+      case "cmyka":
+        return [...O([this.r, this.g, this.b]), this.a];
+      case "oklch":
+        return d([this.r, this.g, this.b]);
+      case "oklcha":
+        return [...d([this.r, this.g, this.b]), this.a];
+      case "oklab":
+        return T([this.r, this.g, this.b]);
+      case "oklaba":
+        return [...T([this.r, this.g, this.b]), this.a];
+      default:
+        return [this.r, this.g, this.b];
+    }
+  }
+  getLuminance() {
+    let s = l(this.r), r = l(this.g), t = l(this.b);
+    return 0.2126 * s + 0.7152 * r + 0.0722 * t;
+  }
+  contrastRatio(s) {
+    let r = this.getLuminance(), t = s.getLuminance(), [n, a] = r >= t ? [r, t] : [t, r];
+    return (n + 0.05) / (a + 0.05);
+  }
+  bestContrastForeground() {
+    let s = new e(255, 255, 255, 1), r = new e(0, 0, 0, 1), t = this.contrastRatio(s), n = this.contrastRatio(r);
+    return t >= n ? s : r;
+  }
+}
+
+// ../../node_modules/.bun/@kaynooo+utils@2.31.0+d0769e28dc4dad16/node_modules/@kaynooo/utils/dist/chunk-y1msbssb.js
+var r = 39;
+var o = 49;
+var f2 = "\x1B[";
+var C2 = { reset: [0, 0], bold: [1, 22], dim: [2, 22], italic: [3, 23], underline: [4, 24], inverse: [7, 27], hidden: [8, 28], strikethrough: [9, 29], black: [30, r], red: [31, r], green: [32, r], yellow: [33, r], blue: [34, r], magenta: [35, r], cyan: [36, r], white: [37, r], gray: [90, r], grey: [90, r], blackBright: [90, r], redBright: [91, r], greenBright: [92, r], yellowBright: [93, r], blueBright: [94, r], magentaBright: [95, r], cyanBright: [96, r], whiteBright: [97, r], bgBlack: [40, o], bgRed: [41, o], bgGreen: [42, o], bgYellow: [43, o], bgBlue: [44, o], bgMagenta: [45, o], bgCyan: [46, o], bgWhite: [47, o], bgBlackBright: [100, o], bgRedBright: [101, o], bgGreenBright: [102, o], bgYellowBright: [103, o], bgBlueBright: [104, o], bgMagentaBright: [105, o], bgCyanBright: [106, o], bgWhiteBright: [107, o], rgb: (i, n, a, l = "fg") => [`${l === "fg" ? 38 : 48};2;${i};${n};${a}`, l === "fg" ? r : o], hex: (i, n = "fg") => {
+  let [a, l, s] = e.from("hex", i).to("rgb");
+  return [`${n === "fg" ? 38 : 48};2;${a};${l};${s}`, n === "fg" ? r : o];
+}, ansi256: (i, n = "fg") => [`${n === "fg" ? 38 : 48};5;${i}`, n === "fg" ? r : o] };
+var b = new Set(["", "1", "2", "3", "true"]);
+function h(i, n = globalThis.process?.env ?? {}) {
+  if (n.FORCE_COLOR !== undefined)
+    return b.has(n.FORCE_COLOR);
+  if (n.NO_COLOR !== undefined || n.NODE_DISABLE_COLORS !== undefined || n.TERM === "dumb")
+    return false;
+  return i?.isTTY === true;
+}
+function d2(i, n, a) {
+  if (!h(a.stream ?? globalThis.process?.stdout, a.env))
+    return n;
+  let l = "", s = "";
+  for (let g = 0, y = i.length;g < y; g++) {
+    let [c, p] = i[g];
+    l += `${f2}${c}m`, s = `${f2}${p}m${s}`;
+  }
+  return l + n + s;
+}
+function u(i, n = []) {
+  return new Proxy((l) => d2(n, l, i), { get(l, s) {
+    let g = C2[s];
+    if (Array.isArray(g))
+      return u(i, [...n, g]);
+    if (typeof g === "function")
+      return (...y) => u(i, [...n, g(...y)]);
+    throw Error(`Unknown style: ${String(s)}`);
+  } });
+}
+function le(i = {}) {
+  return u(i);
+}
+var t = le();
+
+// ../kit/src/style.ts
+function takesControlCodes(stream, env = process2.env) {
+  return stream.isTTY === true && env.NO_COLOR === undefined && env.NODE_DISABLE_COLORS === undefined && env.TERM !== "dumb";
+}
+function paint(stream, env = process2.env) {
+  return le({ stream: { isTTY: takesControlCodes(stream, env) }, env });
+}
+var STATUSES = {
+  passed: { symbol: "\u2713", words: ["passed", "success", "succeeded", "ok"], paint: (colors) => colors.green },
+  failed: { symbol: "\u2717", words: ["failed", "failure", "error", "errored"], paint: (colors) => colors.red },
+  running: { symbol: "\u25CF", words: ["running", "in_progress", "started"], paint: (colors) => colors.cyan },
+  queued: { symbol: "\u25CB", words: ["queued", "waiting", "pending", "created", "blocked", "scheduled"], paint: (colors) => colors.yellow },
+  skipped: { symbol: "-", words: ["skipped", "cancelled", "canceled", "manual"], paint: (colors) => colors.dim }
+};
+var STATUS_OF = new Map(Object.entries(STATUSES).flatMap(([status, { words }]) => words.map((word) => [word, status])));
+
+// ../kit/src/format.ts
+function upTo(text, separator) {
+  const end = text.indexOf(separator);
+  return end === -1 ? text : text.slice(0, end);
+}
+var ESCAPE = String.fromCharCode(27);
+
+// ../kit/src/args.ts
+function jsonOption(holds) {
+  return { type: "boolean", description: holds === undefined ? "print JSON" : `print JSON: ${holds}` };
+}
+
+class Exit extends Error {
+  code;
+  hint;
+  constructor(message, code, hint) {
+    super(message);
+    this.code = code;
+    this.hint = hint;
+  }
+}
+function fail(message, code = 2, hint) {
+  throw new Exit(message, code, hint);
+}
+
+class UsageError extends Exit {
+  constructor(message) {
+    super(message, 2);
+  }
+}
+function badUsage(message) {
+  throw new UsageError(message);
+}
+
+class HelpShown extends Exit {
+  constructor() {
+    super("help shown", 0);
+  }
+}
+
+class Completing {
+  options;
+  constructor(options) {
+    this.options = options;
+  }
+}
+var completion = { active: false };
+var OPTIONAL = /\[[^\]]+\]/g;
+var USAGE_PREFIX = /^usage:\s*/i;
+function usageLine(usage, colors = paint(process3.stdout)) {
+  return `${colors.bold("Usage:")} ${usage.replace(USAGE_PREFIX, "").replaceAll(OPTIONAL, (part) => colors.dim(part))}`;
+}
+function helpText(usage, options, colors = paint(process3.stdout), examples = []) {
+  return [usageLine(usage, colors), "", colors.bold("Options:"), ...optionRows(options, colors), ...exampleRows(examples, colors)].join(`
+`);
+}
+function exampleRows(examples, colors = paint(process3.stdout)) {
+  if (examples.length === 0)
+    return [];
+  return ["", colors.bold("Examples:"), ...examples.map((example) => typeof example === "string" ? `  ${example}` : `  ${example[0]}  ${colors.dim(`# ${example[1]}`)}`)];
+}
+function optionRows(options, colors = paint(process3.stdout)) {
+  const rows = Object.entries(options).map(([name, option]) => {
+    const short = option.short === undefined ? "    " : `${colors.cyan(`-${option.short}`)}, `;
+    const value = option.type === "string" ? ` ${colors.dim("<value>")}` : "";
+    return { flag: `${short}${colors.cyan(`--${name}`)}${value}`, width: `-x, --${name}`.length + (option.type === "string" ? " <value>".length : 0), description: option.description };
+  });
+  const width = Math.max(0, ...rows.map((row) => row.width));
+  return rows.map((row) => `  ${row.flag}${" ".repeat(width - row.width)}  ${colors.dim(row.description)}`);
+}
+var OUTPUT_OPTIONS = {
+  color: { type: "string", description: "auto (on a terminal alone), always or never" },
+  plain: { type: "boolean", description: "plain text, no colour or spinner: --color never" }
+};
+function applyOutput(color, plain, env = process3.env) {
+  const when = plain === true ? "never" : color ?? "auto";
+  if (when === "auto")
+    return;
+  if (when !== "always" && when !== "never")
+    badUsage(`--color takes auto, always or never, not ${when}`);
+  if (when === "always") {
+    env.FORCE_COLOR = "1";
+    delete env.NO_COLOR;
+  } else {
+    env.NO_COLOR = "1";
+    delete env.FORCE_COLOR;
+  }
+}
+function parse(args, usage, options, settings = {}) {
+  const output = Object.fromEntries(Object.entries(OUTPUT_OPTIONS).filter(([name]) => !(name in options)));
+  const all = { ...options, ...output, help: { type: "boolean", short: "h", description: "show this help" } };
+  if (completion.active)
+    throw new Completing(all);
+  const separator = settings.rest === true ? args.indexOf("--") : -1;
+  const own = separator === -1 ? args : args.slice(0, separator);
+  const rest = separator === -1 ? undefined : args.slice(separator + 1);
+  let parsed;
+  try {
+    parsed = parseArgs({ args: own, options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
+  } catch (error) {
+    badUsage(parseError(error));
+  }
+  const values = parsed.values;
+  applyOutput("color" in output ? values.color : undefined, "plain" in output ? values.plain : undefined);
+  if (values.help === true) {
+    console.log(helpText(usage, all, undefined, settings.examples));
+    throw new HelpShown;
+  }
+  if (settings.positionals !== undefined)
+    checkPositionals(parsed.positionals, settings.positionals);
+  return { ...parsed, positionals: parsed.positionals, rest };
+}
+function checkPositionals(given, names) {
+  const variadic = names.at(-1)?.replace("]", "").endsWith("...") === true;
+  const required = names.filter((name) => !name.startsWith("[")).length;
+  if (given.length < required)
+    badUsage(`missing ${names[given.length]}`);
+  if (!variadic && given.length > names.length)
+    badUsage(`unexpected argument ${given[names.length]}`);
+}
+function parseError(error) {
+  const message = upTo(error instanceof Error ? error.message : String(error), ". ");
+  return `${message.charAt(0).toLowerCase()}${message.slice(1)}`;
+}
+async function readInput(path, { noStdin = "nothing is piped on stdin" } = {}) {
+  if (path === "-") {
+    if (process3.stdin.isTTY)
+      fail(noStdin);
+    return Bun.stdin.text();
+  }
+  const file = Bun.file(path);
+  if (!await file.exists())
+    fail(`no file ${path}`);
+  return file.text();
+}
+// ../kit/src/cli.ts
+import process4 from "process";
+
+// ../kit/src/text.ts
+var ANSI = new RegExp(`${String.fromCharCode(27)}\\[[\\d;?]*[a-z]`, "gi");
+function distance(a, b) {
+  let previous = Array.from({ length: b.length + 1 }, (_, index) => index);
+  for (const [i, left] of [...a].entries()) {
+    const current = [i + 1];
+    for (const [j, right] of [...b].entries())
+      current.push(Math.min((previous[j + 1] ?? 0) + 1, (current[j] ?? 0) + 1, (previous[j] ?? 0) + (left === right ? 0 : 1)));
+    previous = current;
+  }
+  return previous[b.length] ?? 0;
+}
+
+// ../kit/src/cli.ts
+var LEVEL_OPTIONS = {
+  ...OUTPUT_OPTIONS,
+  help: { type: "boolean", short: "h", description: "show this help" }
+};
+var TOP_OPTIONS = { ...LEVEL_OPTIONS, version: { type: "boolean", short: "v", description: "print the version" } };
+function commandRows(commands, colors) {
+  const width = Math.max(...Object.keys(commands).map((name) => name.length));
+  const groups = new Map([["Commands:", []]]);
+  for (const [name, { summary, group }] of Object.entries(commands)) {
+    const heading = group === undefined ? "Commands:" : `${group}:`;
+    const rows = groups.get(heading) ?? [];
+    rows.push(`  ${colors.cyan(name.padEnd(width))}  ${colors.dim(summary)}`);
+    groups.set(heading, rows);
+  }
+  return [...groups].filter(([, rows]) => rows.length > 0).flatMap(([heading, rows], index) => [...index === 0 ? [] : [""], colors.bold(heading), ...rows]);
+}
+function takeOutputFlags(argv) {
+  let index = 0;
+  for (;index < argv.length; index++) {
+    const word = argv[index];
+    if (word === "--plain")
+      applyOutput(undefined, true);
+    else if (word.startsWith("--color="))
+      applyOutput(word.slice("--color=".length), undefined);
+    else if (word === "--color" && argv[index + 1] !== undefined)
+      applyOutput(argv[++index], undefined);
+    else
+      break;
+  }
+  return argv.slice(index);
+}
+function closest(name, names) {
+  const started = names.find((known) => known.startsWith(name));
+  if (started !== undefined)
+    return started;
+  const [best] = names.map((known) => ({ known, far: distance(name, known) })).sort((a, b) => a.far - b.far);
+  return best !== undefined && best.far <= (name.length < 4 ? 1 : 2) ? best.known : undefined;
+}
+async function help({ path, header, commands, defaultCommand, examples }, stream) {
+  const colors = paint(stream);
+  const prefix = path.join(" ");
+  const fallback = defaultCommand === undefined ? undefined : commands[defaultCommand];
+  const options = fallback !== undefined && "run" in fallback ? await optionsOf(fallback.run) : undefined;
+  const own = Object.entries(options ?? {}).filter(([name]) => !(name in TOP_OPTIONS));
+  return [
+    header(colors),
+    "",
+    usageLine(`${prefix} ${defaultCommand === undefined ? colors.cyan("<command>") : `[${colors.cyan("<command>")}]`} [options]`, colors),
+    "",
+    ...commandRows(commands, colors),
+    ...own.length === 0 ? [] : ["", `${colors.bold(`Options of ${defaultCommand}:`)} ${colors.dim("the command run when none is named")}`, ...optionRows(Object.fromEntries(own), colors)],
+    "",
+    colors.bold("Options:"),
+    ...optionRows(path.length === 1 ? TOP_OPTIONS : LEVEL_OPTIONS, colors),
+    ...exampleRows(examples ?? [], colors),
+    "",
+    `${colors.dim("Run")} ${prefix} ${colors.cyan("<command>")} --help ${colors.dim("for its options.")}`
+  ].join(`
+`);
+}
+function printError(prefix, message, hint, cause) {
+  const colors = paint(process4.stderr);
+  const styled = takesControlCodes(process4.stderr);
+  const head = styled ? `${colors.red.bold("error")} ${colors.dim(`${prefix}:`)}` : `error: ${prefix}:`;
+  const under = (label, text, tint) => text === undefined ? "" : `
+  ${styled ? tint(label) : `${label}:`} ${text}`;
+  console.error(`${head} ${message}${under("cause", cause, colors.dim)}${under("hint", hint, colors.yellow)}`);
+}
+function reportThrown(prefix, error, redact = (text) => text) {
+  if (error instanceof HelpShown)
+    return 0;
+  const help = error instanceof UsageError ? `run ${prefix} --help for its options` : undefined;
+  const named = error instanceof Error && !(error instanceof Exit) && error.name !== "Error" ? `${error.name}: ${error.message}` : undefined;
+  const cause = error instanceof Error && error.cause instanceof Error ? redact(error.cause.message) : undefined;
+  printError(prefix, redact(named ?? (error instanceof Error ? error.message : String(error))), error instanceof Exit ? error.hint ?? help : undefined, cause);
+  return error instanceof Exit ? error.code : 1;
+}
+async function dispatch(level, typed, { version, redact }) {
+  const prefix = level.path.join(" ");
+  let argv;
+  try {
+    argv = takeOutputFlags(typed);
+  } catch (error) {
+    return reportThrown(prefix, error);
+  }
+  const [name, ...args] = argv;
+  if (name === undefined && level.path.length > 1) {
+    console.error(await help(level, process4.stderr));
+    return 2;
+  }
+  if (name === undefined || name === "help" || name === "--help" || name === "-h") {
+    console.log(await help(level, process4.stdout));
+    return 0;
+  }
+  if (level.path.length === 1 && (name === "--version" || name === "-v")) {
+    console.log(version);
+    return 0;
+  }
+  let command = level.commands[level.aliases?.[name] ?? name];
+  let rest = args;
+  if (command === undefined && level.defaultCommand !== undefined) {
+    command = level.commands[level.defaultCommand];
+    rest = argv;
+  }
+  if (command === undefined) {
+    const meant = closest(name, Object.keys(level.commands));
+    printError(prefix, `no command ${name}`, meant === undefined ? `run ${prefix} --help for its commands` : `did you mean ${meant}?`);
+    return 2;
+  }
+  if ("commands" in command) {
+    const { summary } = command;
+    return dispatch({ path: [...level.path, name], header: (colors) => `${colors.bold(`${prefix} ${name}`)}  ${summary}`, commands: command.commands, aliases: command.aliases, defaultCommand: undefined, examples: command.examples }, rest, { version, redact });
+  }
+  try {
+    return await command.run(rest);
+  } catch (error) {
+    return reportThrown(`${prefix} ${name}`, error, redact);
+  }
+}
+var COMPLETE = "__complete";
+var FILES = "__files__";
+async function optionsOf(run) {
+  completion.active = true;
+  try {
+    await run([]);
+  } catch (error) {
+    if (error instanceof Completing)
+      return error.options;
+  } finally {
+    completion.active = false;
+  }
+  return {};
+}
+async function leafCandidates(run, words) {
+  if (!(words.at(-1) ?? "").startsWith("-"))
+    return [FILES];
+  return Object.entries(await optionsOf(run)).map(([name, option]) => `--${name}	${option.description}`);
+}
+async function candidates(commands, aliases, defaultCommand, words) {
+  const [word = "", ...rest] = words;
+  const command = commands[aliases?.[word] ?? word];
+  if (rest.length === 0 && !word.startsWith("-"))
+    return Object.entries(commands).map(([name, { summary }]) => `${name}	${summary}`);
+  if (command === undefined) {
+    const fallback = defaultCommand === undefined ? undefined : commands[defaultCommand];
+    return fallback !== undefined && "run" in fallback ? leafCandidates(fallback.run, words) : [];
+  }
+  return "commands" in command ? candidates(command.commands, command.aliases, undefined, rest) : leafCandidates(command.run, rest);
+}
+async function printCandidates(found) {
+  for (const line of await found)
+    console.log(line);
+  return 0;
+}
+async function runCli(cli, argv = process4.argv.slice(2)) {
+  if (argv[0] === COMPLETE)
+    return printCandidates(candidates(cli.commands, cli.aliases, cli.defaultCommand, argv.slice(1)));
+  return dispatch({ path: [cli.name], header: (colors) => `${colors.bold(cli.name)} ${colors.dim(cli.version)}  ${cli.about}`, commands: cli.commands, aliases: cli.aliases, defaultCommand: cli.defaultCommand, examples: cli.examples }, argv, { version: cli.version, redact: cli.redact });
+}
+// ../kit/src/process.ts
+import { constants } from "os";
+async function collect(stream, name, chunks) {
+  for await (const data of stream)
+    chunks.push({ stream: name, data });
+}
+function exitCodeOf(code, signal) {
+  if (code !== null)
+    return code;
+  if (typeof signal === "number")
+    return 128 + signal;
+  return signal === null ? 129 : 128 + constants.signals[signal];
+}
+async function runCommand(argv, { cwd, env, stdin = "ignore" } = {}) {
+  const chunks = [];
+  const proc = Bun.spawn(argv, { ...cwd === undefined ? {} : { cwd }, ...env === undefined ? {} : { env }, stdin, stdout: "pipe", stderr: "pipe" });
+  await Promise.all([collect(proc.stdout, "stdout", chunks), collect(proc.stderr, "stderr", chunks)]);
+  await proc.exited;
+  const output = Buffer.concat(chunks.map(({ data }) => data));
+  return { code: exitCodeOf(proc.exitCode, proc.signalCode), chunks, output, text: output.toString() };
+}
+// package.json
+var version = "0.3.0";
+
+// ../kit/src/shell.ts
+var SEPARATORS = new Set([`
+`, ";", "|"]);
+var PLAIN_BREAKERS = new Set(["<", ">", "(", ")", "&", "|"]);
+var WHITESPACE = /\s/;
+var ASSIGNMENT = /^\w+=/;
+var TRAILING_SLASHES = /\/+$/;
+var LEADING_TILDE = /^~(?=\/|$)/;
+var LEADING_TABS = /^\t+/;
+var OPENERS = /^[({]+/;
+var CLOSERS = /[)}]+$/;
+var DOUBLE_QUOTED_ESCAPES = new Set(["$", "`", '"', "\\"]);
+var HEREDOC = /^<<(-?)[ \t]*(?:'([^']*)'|"([^"]*)"|([^\s;&|<>()-][^\s;&|<>()]*))/;
+var WRAPPERS = new Set(["command", "env", "sudo", "exec", "nohup", "time"]);
+function separatorWidth(command, i) {
+  const pair = command.slice(i, i + 2);
+  if (pair === "&&" || pair === "||")
+    return 2;
+  const char = command[i] ?? "";
+  if (char === "&")
+    return command[i - 1] === ">" || command[i - 1] === "<" || command[i + 1] === ">" ? 0 : 1;
+  return SEPARATORS.has(char) ? 1 : 0;
+}
+function heredocEnd(command, newline, words) {
+  let lineStart = newline + 1;
+  for (const { word, stripsTabs } of words) {
+    while (lineStart <= command.length) {
+      const next = command.indexOf(`
+`, lineStart);
+      const lineEnd = next === -1 ? command.length : next;
+      const line = command.slice(lineStart, lineEnd);
+      lineStart = lineEnd + 1;
+      if ((stripsTabs ? line.replace(LEADING_TABS, "") : line) === word)
+        break;
+    }
+  }
+  return Math.min(lineStart - 1, command.length);
+}
+function withoutRanges(command, start, end, ranges) {
+  let text = "";
+  let at = start;
+  for (const [from, to] of ranges) {
+    if (to <= start || from >= end)
+      continue;
+    text += command.slice(at, Math.max(at, from));
+    at = Math.max(at, to);
+  }
+  return text + command.slice(at, end);
+}
+function splitCommand(command) {
+  const bounds = [];
+  const bodies = [];
+  let heredocs = [];
+  let start = 0;
+  let quote = null;
+  for (let i = 0;i < command.length; i++) {
+    const char = command[i] ?? "";
+    if (char === "\\" && quote !== "'") {
+      i++;
+      continue;
+    }
+    if (quote !== null) {
+      if (char === quote)
+        quote = null;
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      quote = char;
+      continue;
+    }
+    const heredoc = char === "<" && command[i + 1] === "<" && command[i + 2] !== "<" ? HEREDOC.exec(command.slice(i)) : null;
+    if (heredoc) {
+      heredocs.push({ word: heredoc[2] ?? heredoc[3] ?? heredoc[4] ?? "", stripsTabs: heredoc[1] === "-", isQuoted: heredoc[4] === undefined });
+      i += heredoc[0].length - 1;
+      continue;
+    }
+    if (char === `
+` && heredocs.length > 0) {
+      const end = heredocEnd(command, i, heredocs);
+      bodies.push([i, end, heredocs.some((each) => !each.isQuoted)]);
+      heredocs = [];
+      i = end - 1;
+      continue;
+    }
+    const width = separatorWidth(command, i);
+    if (width === 0)
+      continue;
+    bounds.push([start, i, command.slice(i, i + width)]);
+    i += width - 1;
+    start = i + 1;
+  }
+  bounds.push([start, command.length, ""]);
+  const ranges = bodies.map(([from, to]) => [from, to]);
+  return bounds.map(([from, to, separator]) => ({
+    text: command.slice(from, to),
+    start: from,
+    end: to,
+    command: withoutRanges(command, from, to, ranges),
+    separator,
+    expanded: bodies.filter(([body, , expands]) => expands && body >= from && body < to).map(([body, bodyEnd]) => command.slice(body, bodyEnd)).join("")
+  }));
+}
+function isPlain(text) {
+  let quote = null;
+  for (let i = 0;i < text.length; i++) {
+    const char = text[i] ?? "";
+    const isSubstitution = char === "`" || char === "$" && text[i + 1] === "(";
+    if (char === "\\" && quote !== "'")
+      i++;
+    else if (quote !== null && char === quote)
+      quote = null;
+    else if (quote === null && (char === '"' || char === "'"))
+      quote = char;
+    else if (quote !== "'" && (isSubstitution || quote === null && PLAIN_BREAKERS.has(char)))
+      return false;
+  }
+  return quote === null;
+}
+function closingParen(text, open) {
+  let depth = 0;
+  let quote = null;
+  for (let i = open;i < text.length; i++) {
+    const char = text[i] ?? "";
+    if (char === "\\" && quote !== "'") {
+      i++;
+    } else if (quote !== null) {
+      if (char === quote)
+        quote = null;
+    } else if (char === "'" || char === '"') {
+      quote = char;
+    } else if (char === "(") {
+      depth++;
+    } else if (char === ")" && --depth === 0) {
+      return i;
+    }
+  }
+  return text.length;
+}
+function closingBackquote(text, open) {
+  for (let i = open + 1;i < text.length; i++) {
+    if (text[i] === "\\")
+      i++;
+    else if (text[i] === "`")
+      return i;
+  }
+  return text.length;
+}
+function bodies(text, isQuoting) {
+  const found = [];
+  let quote = null;
+  for (let i = 0;i < text.length; i++) {
+    const char = text[i] ?? "";
+    if (quote === "'") {
+      if (char === "'")
+        quote = null;
+    } else if (char === "\\") {
+      i++;
+    } else if (char === "$" && text[i + 1] === "(") {
+      const end = closingParen(text, i + 1);
+      found.push(text.slice(i + 2, end));
+      i = end;
+    } else if (char === "`") {
+      const end = closingBackquote(text, i);
+      found.push(text.slice(i + 1, end));
+      i = end;
+    } else if (isQuoting && char === '"') {
+      quote = quote === null ? char : null;
+    } else if (isQuoting && char === "'" && quote === null) {
+      quote = char;
+    }
+  }
+  return found;
+}
+function substitutions(command) {
+  return splitCommand(command).flatMap((piece) => [...bodies(piece.command, true), ...bodies(piece.expanded, false)]);
+}
+function words(text) {
+  const found = [];
+  let current = "";
+  let isStarted = false;
+  let isProse = false;
+  let quote = null;
+  for (let i = 0;i < text.length; i++) {
+    const char = text[i] ?? "";
+    const isContinuation = char === "\\" && quote !== "'" && text[i + 1] === `
+`;
+    if (isContinuation)
+      i++;
+    if (quote === null && (isContinuation || WHITESPACE.test(char))) {
+      if (isStarted)
+        found.push({ text: current, isProse });
+      current = "";
+      isStarted = false;
+      isProse = false;
+      continue;
+    }
+    if (isContinuation)
+      continue;
+    isStarted = true;
+    if (char === "\\" && quote === '"' && !DOUBLE_QUOTED_ESCAPES.has(text[i + 1] ?? ""))
+      current += char;
+    else if (char === "\\" && quote !== "'")
+      current += text[++i] ?? "";
+    else if (quote !== null && char === quote)
+      quote = null;
+    else if (quote === null && (char === '"' || char === "'"))
+      quote = char;
+    else
+      current += char;
+    isProse ||= quote !== null && WHITESPACE.test(char);
+  }
+  if (isStarted)
+    found.push({ text: current, isProse });
+  return found;
+}
+function tokenize(text) {
+  return words(text).map((word) => word.text);
+}
+function parseCommand(text) {
+  const tokens = tokenize(text);
+  const assignments = [];
+  let isWrapped = false;
+  for (;; ) {
+    const first = tokens[0] ?? "";
+    if (OPENERS.test(first)) {
+      isWrapped = true;
+      const rest = first.replace(OPENERS, "");
+      if (rest === "")
+        tokens.shift();
+      else
+        tokens[0] = rest;
+    } else if (ASSIGNMENT.test(first)) {
+      assignments.push(tokens.shift() ?? "");
+    } else if (WRAPPERS.has(first)) {
+      isWrapped = true;
+      tokens.shift();
+      while (tokens[0]?.startsWith("-"))
+        tokens.shift();
+    } else {
+      break;
+    }
+  }
+  const closers = CLOSERS.exec(text.trimEnd())?.[0].length ?? 0;
+  const word = tokens.at(-1) ?? "";
+  const trimmed = word.length - (CLOSERS.exec(word)?.[0].length ?? 0);
+  const last = word.slice(0, Math.max(trimmed, word.length - closers));
+  if (tokens.length > 0)
+    tokens.splice(-1, 1, ...last === "" ? [] : [last]);
+  const [program = "", ...args] = tokens;
+  return { program: program.split("/").pop() ?? "", args, assignments, isWrapped };
+}
+function replacePieces(command, replacements) {
+  let result = command;
+  for (const [piece, text] of [...replacements].sort(([a], [b]) => b.start - a.start)) {
+    result = result.slice(0, piece.start) + text + result.slice(piece.end);
+  }
+  return result;
+}
+function parentDir(path) {
+  const cut = path.replace(TRAILING_SLASHES, "").lastIndexOf("/");
+  return cut <= 0 ? "/" : path.slice(0, cut);
+}
+function resolvePath(base, arg, home) {
+  const expanded = arg.replace(LEADING_TILDE, home);
+  const parts = [];
+  for (const part of (expanded.startsWith("/") ? expanded : `${base}/${expanded}`).split("/")) {
+    if (part === "..")
+      parts.pop();
+    else if (part !== "" && part !== ".")
+      parts.push(part);
+  }
+  return `/${parts.join("/")}`;
+}
+
+// ../db/src/guard.ts
+var WORD_START = /[a-z_]/i;
+var WORD_PART = /[\w$]/;
+var SPACE = /\s/;
+var ESCAPE_PREFIX = /e/i;
+var DOLLAR_TAG = /^\$(?:[a-z_]\w*)?\$/i;
+var LOCK_KIND = /^(?:update|share|no|key)$/;
+var DIGITS = /\d/;
+var COMMAND_ENDS = ";";
+var UNCLOSED = "unclosed";
+var PRIVILEGED_SET = new Set(["role", "session", "transaction"]);
+var READ_STARTS = new Set(["select", "with", "values", "table", "show", "explain"]);
+var WRITE_WORDS = new Set(["insert", "update", "delete", "merge", "truncate", "drop", "alter", "create", "grant", "revoke", "into", "call", "vacuum", "lock", "refresh", "reindex", "cluster", "do"]);
+var SIDE_EFFECT_FUNCTIONS = /^(?:nextval|setval|set_config|pg_terminate_backend|pg_cancel_backend|pg_reload_conf|pg_rotate_logfile|pg_switch_wal|pg_create_restore_point|pg_advisory_lock\w*|pg_advisory_xact_lock\w*|pg_try_advisory\w*|pg_notify|lo_\w+|dblink\w*|pg_read_file|pg_read_binary_file|pg_ls_dir|query_to_xml\w*|pg_logical_\w+|pg_replication_\w+|pg_drop_replication_slot|pg_stat_reset\w*|pg_promote|pg_file_\w+)$/;
+function tokenize2(sql) {
+  const tokens = [];
+  let at = 0;
+  while (at < sql.length) {
+    const char = sql.charAt(at);
+    const next = sql.charAt(at + 1);
+    if (SPACE.test(char)) {
+      at++;
+    } else if (char === "-" && next === "-") {
+      const end = sql.indexOf(`
+`, at);
+      at = end === -1 ? sql.length : end + 1;
+    } else if (char === "/" && next === "*" && sql.charAt(at + 2) === "!") {
+      at += 3;
+      while (DIGITS.test(sql.charAt(at)))
+        at++;
+    } else if (char === "/" && next === "*") {
+      at = skipComment(sql, at);
+    } else if (char === "'" || char === '"' || char === "`") {
+      const backslashes = char === "'" && ESCAPE_PREFIX.test(sql.charAt(at - 1)) && !WORD_PART.test(sql.charAt(at - 2));
+      const end = skipQuoted(sql, at, char, backslashes);
+      at = end ?? sql.length;
+      tokens.push({ kind: "punct", text: end === undefined ? UNCLOSED : char });
+    } else if (char === "$" && DOLLAR_TAG.test(sql.slice(at))) {
+      const tag = DOLLAR_TAG.exec(sql.slice(at))?.[0] ?? "$$";
+      const end = sql.indexOf(tag, at + tag.length);
+      at = end === -1 ? sql.length : end + tag.length;
+      tokens.push({ kind: "punct", text: end === -1 ? UNCLOSED : "$" });
+    } else if (WORD_START.test(char)) {
+      let end = at + 1;
+      while (end < sql.length && WORD_PART.test(sql.charAt(end)))
+        end++;
+      tokens.push({ kind: "word", text: sql.slice(at, end).toLowerCase() });
+      at = end;
+    } else {
+      tokens.push({ kind: "punct", text: char });
+      at++;
+    }
+  }
+  return tokens;
+}
+function skipComment(sql, start) {
+  let depth = 0;
+  let at = start;
+  while (at < sql.length) {
+    if (sql.startsWith("/*", at)) {
+      depth++;
+      at += 2;
+    } else if (sql.startsWith("*/", at)) {
+      depth--;
+      at += 2;
+      if (depth === 0)
+        return at;
+    } else {
+      at++;
+    }
+  }
+  return sql.length;
+}
+function skipQuoted(sql, start, quote, backslashes) {
+  let at = start + 1;
+  while (at < sql.length) {
+    const char = sql.charAt(at);
+    if (backslashes && char === "\\") {
+      at += 2;
+    } else if (char === quote) {
+      if (sql.charAt(at + 1) !== quote)
+        return at + 1;
+      at += 2;
+    } else {
+      at++;
+    }
+  }
+  return;
+}
+function splitStatements(tokens) {
+  const statements = [[]];
+  for (const token of tokens) {
+    if (token.kind === "punct" && token.text === COMMAND_ENDS)
+      statements.push([]);
+    else
+      statements.at(-1)?.push(token);
+  }
+  return statements.filter((statement) => statement.length > 0);
+}
+var isPunct = (token, text) => token?.kind === "punct" && token.text === text;
+function copyReads(statement, index) {
+  let depth = 0;
+  for (const [at, token] of statement.entries()) {
+    if (at <= index)
+      continue;
+    if (isPunct(token, "("))
+      depth++;
+    else if (isPunct(token, ")"))
+      depth--;
+    else if (depth === 0 && token.kind === "word" && (token.text === "from" || token.text === "to"))
+      return token.text === "to" && (statement[at + 1]?.text === "stdout" || isPunct(statement[index - 1], "\\"));
+  }
+  return false;
+}
+function statementWrites(statement) {
+  const first = statement[0];
+  const start = isPunct(first, "\\") ? 1 : 0;
+  const reasons = [];
+  for (const [index, token] of statement.entries()) {
+    if (isPunct(token, UNCLOSED))
+      reasons.push("has a quote that never closes");
+    if (token.kind !== "word")
+      continue;
+    if (SIDE_EFFECT_FUNCTIONS.test(token.text)) {
+      reasons.push(`calls ${token.text}`);
+    } else if (isPunct(statement[index - 1], ".")) {
+      continue;
+    } else if (token.text === "set") {
+      if (index !== start || PRIVILEGED_SET.has(statement[index + 1]?.text ?? ""))
+        reasons.push("uses SET");
+    } else if (token.text === "copy") {
+      if (!copyReads(statement, index))
+        reasons.push("uses COPY");
+    } else if (WRITE_WORDS.has(token.text)) {
+      reasons.push(`uses ${token.text.toUpperCase()}`);
+    } else if (token.text === "analyze" && first?.text !== "explain") {
+      reasons.push("uses ANALYZE");
+    } else if (token.text === "for" && LOCK_KIND.test(statement[index + 1]?.text ?? "")) {
+      reasons.push("takes row locks with FOR UPDATE or SHARE");
+    } else if (token.text === "comment" && statement[index + 1]?.text === "on") {
+      reasons.push("uses COMMENT ON");
+    }
+  }
+  return reasons;
+}
+function writes(sql) {
+  return [...new Set(splitStatements(tokenize2(sql)).flatMap(statementWrites))];
+}
+
+// ../db/src/clients.ts
+var SQL_CLIENTS = new Set(["psql", "mysql", "mariadb", "pgcli", "mycli", "sqlite3"]);
+var WRITING_TOOLS = new Set(["dropdb", "createdb", "pg_restore"]);
+var CONSOLE_PROGRAMS = new Set(["php", "docker", "symfony", "console", "artisan"]);
+var STATEMENT_OPTIONS = new Set(["-c", "--command", "-e", "--execute"]);
+var FILE_OPTIONS = new Set(["-f", "--file", "<"]);
+var PRINTERS = new Set(["echo", "printf"]);
+var LIST_OPTIONS = new Set(["-l", "--list"]);
+var WRITING_CONSOLE = /^(?:doctrine:(?:migrations:(?:migrate|execute|rollup)|schema:(?:update|create|drop)|database:(?:create|drop)|fixtures:load)|migrate(?::\w+)?|db:(?:seed|wipe))$/;
+var TEST_SCOPED = /(?:^|[^a-z])test/i;
+var SHOT_STACK = /\.worktrees\/[^/\s]+\/shot(?:\/|$)|--shot(?:-|$)/;
+var SQL_WRITE = "Statements that write (INSERT, UPDATE, DELETE, DDL, migrations, fixtures) are handed over: list the exact command for the user to run. Only a clearly test-only database runs them directly.";
+function hasWrite(statement) {
+  return writes(statement).length > 0;
+}
+function programOf(word) {
+  return word.split("/").pop() ?? "";
+}
+function isTestScoped(words) {
+  const client = words.findIndex((word) => SQL_CLIENTS.has(programOf(word)));
+  return words.some((word, i) => (TEST_SCOPED.test(word) || SHOT_STACK.test(word)) && (i <= client || client === -1 || !STATEMENT_OPTIONS.has(words[i - 1] ?? "") && !FILE_OPTIONS.has(words[i - 1] ?? "")));
+}
+async function sqlViolation(command, read) {
+  const pieces = splitCommand(command);
+  let inShotStack = false;
+  for (const [index, piece] of pieces.entries()) {
+    const words = tokenize(piece.command);
+    const { program, args } = parseCommand(piece.command);
+    if (program === "cd")
+      inShotStack = SHOT_STACK.test(args[0] ?? "");
+    if (inShotStack || isTestScoped(words))
+      continue;
+    if (WRITING_TOOLS.has(program) && !words.some((word) => LIST_OPTIONS.has(word)))
+      return SQL_WRITE;
+    if (CONSOLE_PROGRAMS.has(program) && words.some((word) => WRITING_CONSOLE.test(word)))
+      return SQL_WRITE;
+    const client = words.findIndex((word) => SQL_CLIENTS.has(programOf(word)));
+    if (client === -1)
+      continue;
+    const files = words.filter((_, i) => i > client && FILE_OPTIONS.has(words[i - 1] ?? ""));
+    const before = index === 0 ? null : parseCommand(pieces[index - 1]?.command ?? "");
+    const statements = [
+      ...words.filter((_, i) => i > client && STATEMENT_OPTIONS.has(words[i - 1] ?? "")),
+      piece.text === piece.command ? "" : piece.text.slice(piece.text.indexOf(`
+`)),
+      before !== null && PRINTERS.has(before.program) ? before.args.join(" ") : "",
+      ...(await Promise.all(files.map(read))).map((text) => text ?? "")
+    ];
+    if (statements.some(hasWrite))
+      return SQL_WRITE;
+  }
+  return null;
+}
+
+// ../env/src/files.ts
+var ENV_FILE = /^\.env(?:\..+)?$/;
+var TEMPLATE = /\.(?:example|sample|template|dist|defaults)$/;
+
+// ../env/src/guard.ts
+var REDIRECT = /^\d*[<>]+&?/;
+var ENV_DUMP = /(?:console\.\w+|JSON\.stringify|Object\.(?:entries|keys|values)|print)\(\s*process\.env\s*[,)]/;
+var HARMLESS = new Set(["ev", "redact", "ls", "stat", "test", "[", "[[", "touch"]);
+var GIT_HARMLESS = new Set(["check-ignore", "ls-files", "status"]);
+var ENV_PRINTERS = new Set(["env", "printenv"]);
+var DOCKER = new Set(["docker", "docker-compose"]);
+var SHELLS = new Set(["sh", "bash", "zsh", "ash"]);
+var DOCKER_VALUE_OPTIONS = new Set(["-f", "--file", "-p", "--project-name", "--profile", "--env-file", "--project-directory", "--ansi", "--progress", "--parallel", "-H", "--host", "-c", "--context", "--config", "-l", "--log-level"]);
+var EXEC_VALUE_OPTIONS = new Set(["-e", "--env", "--env-file", "-u", "--user", "-w", "--workdir", "--index", "--detach-keys"]);
+var CONFIG_LISTS = new Set(["--services", "--volumes", "--profiles", "--images", "--networks", "--hash", "-q", "--quiet"]);
+var FORMAT_OPTIONS = new Set(["-f", "--format"]);
+var WHOLE_FORMAT = /Env|\{\{\s*json\s+\.\s*\}\}|^json$/;
+var USE_EV = '.env files hold secrets that must never reach the transcript, so they are not read, edited or printed directly. Use `ev` instead: `ev list`, `ev get KEY` (masked), `ev grep <regex>` for the keys matching it, `ev show <rev>:<file>` for one at a git revision, `printf %s "$value" | ev set KEY [file]` (`--empty` for an empty value), `ev unset KEY`, `ev mv KEY --from .env --to .env.local`, `ev diff a b`, `ev missing`; and pipe output that may carry a secret through `redact`, as `docker compose exec <svc> printenv | redact` or `docker compose config | redact`. If `ev` is missing: `bun install -g @kaynooo/env-tools`.';
+function isEnvFile(path) {
+  const name = path.slice(Math.max(path.lastIndexOf("/"), path.lastIndexOf(":")) + 1);
+  return (ENV_FILE.test(name) || name === ".env*") && !TEMPLATE.test(name);
+}
+function namesEnvFile(word, previous) {
+  if (previous === "--env-file" || word.startsWith("--env-file="))
+    return false;
+  const bare = word.replace(REDIRECT, "");
+  return isEnvFile(bare.includes("=") ? bare.slice(bare.indexOf("=") + 1) : bare);
+}
+function firstOperand(words, valueOptions) {
+  for (let i = 0;i < words.length; i++) {
+    const word = words[i] ?? "";
+    if (valueOptions.has(word))
+      i++;
+    else if (!word.startsWith("-"))
+      return i;
+  }
+  return words.length;
+}
+function printsEnv([program = "", ...args]) {
+  if (SHELLS.has(program) && args[0] === "-c")
+    return splitCommand(args[1] ?? "").some((piece) => ENV_PRINTERS.has(tokenize(piece.command)[0] ?? ""));
+  return ENV_PRINTERS.has(program);
+}
+function dumpsContainerEnv(program, args) {
+  if (!DOCKER.has(program))
+    return false;
+  const afterOptions = (words) => words.slice(firstOperand(words, DOCKER_VALUE_OPTIONS));
+  let rest = afterOptions(args);
+  const isCompose = program === "docker-compose" || rest[0] === "compose";
+  if (program === "docker" && isCompose)
+    rest = afterOptions(rest.slice(1));
+  const [subcommand = "", ...after] = rest;
+  if (subcommand === "exec")
+    return printsEnv(after.slice(firstOperand(after, EXEC_VALUE_OPTIONS) + 1));
+  if (isCompose)
+    return subcommand === "config" && !after.some((word) => CONFIG_LISTS.has(word));
+  if (subcommand !== "inspect" && (subcommand !== "container" || after[0] !== "inspect"))
+    return false;
+  const format = after.find((_, i) => FORMAT_OPTIONS.has(after[i - 1] ?? "")) ?? after.find((word) => word.startsWith("--format="))?.slice("--format=".length);
+  return format === undefined || WHOLE_FORMAT.test(format);
+}
+function readsEnv(piece) {
+  const { program, args } = parseCommand(piece.command);
+  const found = words(piece.command);
+  if (program === "" || HARMLESS.has(program) || program === "git" && GIT_HARMLESS.has(args[0] ?? ""))
+    return false;
+  return found.some((word, index) => !word.isProse && namesEnvFile(word.text, found[index - 1]?.text));
+}
+function touchesEnv(command) {
+  if (ENV_DUMP.test(command))
+    return true;
+  if (substitutions(command).some(touchesEnv))
+    return true;
+  const pieces = splitCommand(command);
+  return pieces.some((piece, index) => {
+    if (readsEnv(piece))
+      return true;
+    const { program, args } = parseCommand(piece.command);
+    if (!dumpsContainerEnv(program, args))
+      return false;
+    for (let at = index;pieces[at]?.separator === "|"; at++) {
+      if (parseCommand(pieces[at + 1]?.command ?? "").program === "redact")
+        return false;
+    }
+    return true;
+  });
+}
+
+// ../git/src/message.ts
+var CONVENTIONAL = /^[a-z]+(?:\([^()\n]+\))?!?: \S/;
+var GIT_MADE = /^(?:Merge |Revert "|fixup! |squash! |amend! )/;
+var TICKET = /^(?:[\w.-]+\/[\w.-]+)?#\d+ - /;
+var BREAKING = /^BREAKING[ -]CHANGE: /;
+var BREAKING_TITLE = /^[a-z]+(?:\([^()\n]+\))?!: /;
+var TRAILER = /^(?:co-authored-by|signed-off-by|reviewed-by|acked-by|tested-by|reported-by|suggested-by|helped-by|change-id):|^\W*generated with\b/i;
+var BULLET = /^\s*(?:[-*+]|\d+[.)])\s/;
+var SENTENCE_END = /[.!?:;)\]`'"]$/;
+var LOWER_START = /^\p{Ll}/u;
+var RULE = 'The rule: a `type(scope): title` line, `!` after the scope for a breaking change, type and scope taken from the repository\'s history; then optionally a blank line and one or two lines on what changed, never a bullet list or a hard-wrapped sentence; then a blank line and one line per ticket, its title copied verbatim, `#<n> - <title>` (`owner/repo#<n> - <title>` for another repository). The message ends there: no Co-Authored-By, Signed-off-by or "Generated with" trailer. Only a breaking change gives full details.';
+var TITLE = `The title is no Conventional Commit. ${RULE}`;
+var TITLE_LINE = `The title takes one line and a blank line follows it. ${RULE}`;
+var TRAILERS = `No trailers, ever: no Co-Authored-By, Signed-off-by or "Generated with" line, no --signoff or --trailer. ${RULE}`;
+var BULLETS = `The body names what changed in a line or two, never a bullet list narrating the diff. ${RULE}`;
+var TOO_LONG = `The body holds at most two lines besides the ticket lines; what goes beyond belongs in the reply. ${RULE}`;
+var WRAPPED = `A body sentence stays on one line however long it runs: never hard-wrap it. ${RULE}`;
+var USE_GC = "Commit with `gc`, which stages exactly the paths given once the message keeps the rule: `gc 'fix(api): retry a timed-out fetch' -m 'A 502 is retried once before failing.' --ticket '#12 - [UC3] Retry failed fetches' -- src/api.ts`.";
+function isDescription(line) {
+  return line !== undefined && line !== "" && !TICKET.test(line);
+}
+function commitMessageViolation(message) {
+  const lines = message.split(`
+`).map((line) => line.trimEnd());
+  while (lines[0] === "")
+    lines.shift();
+  while (lines.at(-1) === "")
+    lines.pop();
+  const [title = "", second, ...body] = lines;
+  if (title === "")
+    return null;
+  if (lines.some((line) => TRAILER.test(line)))
+    return TRAILERS;
+  if (!CONVENTIONAL.test(title) && !GIT_MADE.test(title))
+    return TITLE;
+  if (second !== undefined && second !== "")
+    return TITLE_LINE;
+  if (BREAKING_TITLE.test(title) || body.some((line) => BREAKING.test(line)))
+    return null;
+  const descriptions = body.filter(isDescription);
+  if (descriptions.some((line) => BULLET.test(line)))
+    return BULLETS;
+  if (descriptions.length > 2)
+    return TOO_LONG;
+  const isWrapped = body.some((line, i) => isDescription(line) && isDescription(body[i + 1]) && !SENTENCE_END.test(line) && LOWER_START.test(body[i + 1] ?? ""));
+  return isWrapped ? WRAPPED : null;
+}
+
+// ../out/src/wrap.ts
+var ASSIGNMENT2 = /^\w+=/;
+var EXCLUDED = /(?:^|\s)(?:--json|--help|--version|-h)(?:\s|$)/;
+var BUN_SCRIPT = /^(?:build|check|lint|typecheck|types|test|ci|verify|compile)(?::|$)/;
+var BUN_TOOLS = new Set(["tsc", "tsgo", "eslint", "keslint", "vitest", "jest", "prettier", "playwright", "biome", "vue-tsc"]);
+var BUN_SUBCOMMANDS = new Set(["install", "i", "add", "remove", "rm", "update", "test", "check", "lint", "build"]);
+var STDERR_MERGE = /\s+2>&1$/;
+var FILTERS = new Set(["tail", "head", "grep"]);
+var GREP_SUMMARY = /^(?:-[a-zA-Z]*[cqlL]|--(?:count|quiet|silent|files-with(?:out)?-match(?:es)?)$)/;
+var PHP_VALUE_OPTIONS = new Set(["-d", "-c", "-z"]);
+var BUNX_VALUE_OPTIONS = new Set(["-p", "--package"]);
+var COMPOSE_VALUE_OPTIONS = new Set(["-f", "--file", "-p", "--project-name", "--profile", "--env-file", "--project-directory", "--ansi", "--progress", "--parallel"]);
+var EXEC_VALUE_OPTIONS2 = new Set(["-e", "--env", "--env-file", "-u", "--user", "-w", "--workdir", "--index", "--detach-keys", "--name", "--entrypoint", "-v", "--volume", "-p", "--publish", "-l", "--label", "--cap-add", "--cap-drop", "--pull"]);
+var always = () => true;
+var typecheck = ([sub]) => sub === "typecheck";
+var RULES = {
+  bun: ([sub, script]) => sub !== undefined && (BUN_SUBCOMMANDS.has(sub) || sub === "run" && script !== undefined && BUN_SCRIPT.test(script)),
+  bunx: (args) => {
+    const [tool, ...rest] = afterOptions(args, BUNX_VALUE_OPTIONS);
+    return tool !== undefined && (BUN_TOOLS.has(tool) || (tool === "nuxi" || tool === "nuxt") && typecheck(rest));
+  },
+  tsc: always,
+  tsgo: always,
+  "vue-tsc": always,
+  nuxi: typecheck,
+  nuxt: typecheck,
+  eslint: always,
+  keslint: always,
+  vitest: always,
+  jest: always,
+  pytest: always,
+  phpunit: always,
+  paratest: always,
+  phpstan: always,
+  pest: always,
+  "php-cs-fixer": always,
+  rector: always,
+  php: (args) => listed(afterOptions(args, PHP_VALUE_OPTIONS)),
+  make: always,
+  check: always,
+  just: ([first]) => first !== undefined && !first.startsWith("-"),
+  composer: ([sub]) => sub === "install" || sub === "update" || sub === "require",
+  pip: ([sub]) => sub === "install",
+  cargo: ([sub]) => ["build", "test", "check", "clippy"].includes(sub ?? ""),
+  go: ([sub]) => ["build", "test", "vet"].includes(sub ?? ""),
+  docker: (args) => {
+    if (args[0] === "build")
+      return true;
+    if (args[0] === "exec")
+      return listed(afterOptions(args.slice(1), EXEC_VALUE_OPTIONS2).slice(1));
+    if (args[0] !== "compose")
+      return false;
+    const [sub, ...rest] = afterOptions(args.slice(1), COMPOSE_VALUE_OPTIONS);
+    if (sub === "exec" || sub === "run")
+      return listed(afterOptions(rest, EXEC_VALUE_OPTIONS2).slice(1));
+    return sub === "build" || sub === "pull";
+  }
+};
+function afterOptions(args, valued) {
+  let index = 0;
+  while (args[index]?.startsWith("-") === true) {
+    index += valued.has(args[index] ?? "") ? 2 : 1;
+  }
+  return args.slice(index);
+}
+function scan(command) {
+  const segments = [];
+  const pipes = [];
+  let current = "";
+  let plain = true;
+  for (const piece of splitCommand(command)) {
+    current += piece.text;
+    plain &&= isPlain(piece.text) && piece.separator !== "&";
+    if (piece.separator === "|") {
+      pipes.push(piece.end);
+      current += "|";
+      plain = false;
+      continue;
+    }
+    segments.push(current);
+    current = "";
+  }
+  return { segments: segments.map((segment) => segment.trim()).filter((segment) => segment !== ""), plain, pipes };
+}
+function isFilter(stage) {
+  const { segments, plain } = scan(stage);
+  const [bin, ...args] = tokenize(stage);
+  if (!plain || segments.length !== 1 || bin === undefined || !FILTERS.has(bin))
+    return false;
+  return bin !== "grep" || !args.some((arg) => GREP_SUMMARY.test(arg));
+}
+function withoutFilters(command) {
+  let rest = command;
+  for (let at = scan(rest).pipes.at(-1);at !== undefined && isFilter(rest.slice(at + 1).trim()); at = scan(rest).pipes.at(-1))
+    rest = rest.slice(0, at).trimEnd().replace(STDERR_MERGE, "");
+  return rest;
+}
+function listed(words) {
+  const start = words.findIndex((word) => !ASSIGNMENT2.test(word));
+  const path = words[start];
+  if (path === undefined)
+    return false;
+  return RULES[path.slice(path.lastIndexOf("/") + 1)]?.(words.slice(start + 1)) ?? false;
+}
+function listedSegment(segment) {
+  return !EXCLUDED.test(segment) && listed(tokenize(segment));
+}
+function isCd(segment) {
+  return segment === "cd" || segment.startsWith("cd ");
+}
+function shouldWrap(command) {
+  const { segments, plain } = scan(withoutFilters(command.trim()));
+  if (!plain || !segments.some((segment) => listedSegment(segment)))
+    return false;
+  return segments.every((segment) => isCd(segment) || listedSegment(segment));
+}
+function quoted(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function wrap(command) {
+  const trimmed = withoutFilters(command.trim());
+  if (scan(trimmed).segments.length <= 1 && !ASSIGNMENT2.test(trimmed))
+    return `out -- ${trimmed}`;
+  return `out -- sh -c ${quoted(trimmed)}`;
+}
+
+// ../pkg/src/added.ts
+var REDIRECT2 = /^\d*[<>]/;
+var BARE_REDIRECT = /^\d*(?:[<>]|>>)$/;
+var ADDS = {
+  bun: new Set(["add", "a", "install", "i"]),
+  npm: new Set(["install", "i", "add", "in", "isntall"]),
+  pnpm: new Set(["add"]),
+  yarn: new Set(["add"])
+};
+var VALUE_FLAGS = new Set(["--cwd", "--filter", "-F", "--workspace", "--registry", "--prefix", "-C", "--dir", "--config", "--cache-dir"]);
+var NOT_REGISTRY = /^(?:[./~]|file:|link:|portal:|workspace:|git[+:]|github:|gitlab:|bitbucket:|https?:)|\.tgz$|^[\w.-]+\/[\w.-]+(?:#.*)?$/;
+var NPM_ALIAS = /^(?:@[^/]+\/)?[^@]+@npm:(.+)$/;
+var PUBLISH = /\b(?:ft|cli\.ts)\s+release\b|\b(?:bun|npm|pnpm|yarn)\s+publish\b|\bjust\s+(?:patch|minor|major)\b/;
+function addedPackages(command) {
+  let published = false;
+  return splitCommand(command).flatMap((piece) => {
+    published ||= PUBLISH.test(piece.command);
+    const { program, args } = parseCommand(piece.command);
+    const [sub = "", ...rest] = args;
+    if (published || !ADDS[program]?.has(sub))
+      return [];
+    return rest.flatMap((word, index) => {
+      const previous = rest[index - 1] ?? "";
+      if (word.startsWith("-") || REDIRECT2.test(word) || VALUE_FLAGS.has(previous) || BARE_REDIRECT.test(previous) || NOT_REGISTRY.test(word))
+        return [];
+      return [NPM_ALIAS.exec(word)?.[1] ?? word];
+    });
+  });
+}
+
+// ../pkg/src/pin.ts
+var LOCKFILES = [
+  ["bun.lock", "bun"],
+  ["bun.lockb", "bun"],
+  ["pnpm-lock.yaml", "pnpm"],
+  ["yarn.lock", "yarn"],
+  ["package-lock.json", "npm"]
+];
+var ACTIONS = {
+  bun: actions({ install: ["install", "i"], add: ["add", "a"], remove: ["remove", "rm"], update: ["update"] }),
+  pnpm: actions({ install: ["install", "i"], add: ["add"], remove: ["remove", "rm"], update: ["update", "up"] }),
+  yarn: new Map([...actions({ install: ["", "install"], add: ["add"], remove: ["remove"], update: ["upgrade"] }), ["upgrade-interactive", null], ["import", null]]),
+  npm: actions({
+    install: ["install", "i", "in", "ins", "inst", "insta", "instal", "isnt", "isnta", "isntal", "isntall"],
+    add: ["add"],
+    frozen: ["ci", "clean-install", "ic", "install-clean", "isntall-clean"],
+    remove: ["uninstall", "unlink", "remove", "rm", "r", "un"],
+    update: ["update", "u", "up", "upgrade", "udpate"]
+  })
+};
+var COMMANDS = {
+  bun: { install: "install", frozen: "install --frozen-lockfile", add: "add", remove: "remove", update: "update" },
+  pnpm: { install: "install", frozen: "install --frozen-lockfile", add: "add", remove: "remove", update: "update" },
+  yarn: { install: "install", add: "add", remove: "remove" },
+  npm: { install: "install", frozen: "ci", add: "install", remove: "uninstall", update: "update" }
+};
+var OPTIONS = {
+  bun: { dev: "--dev", exact: "--exact" },
+  pnpm: { dev: "--save-dev", exact: "--save-exact" },
+  yarn: { dev: "--dev", exact: "--exact" },
+  npm: { dev: "--save-dev", exact: "--save-exact" }
+};
+var OPTION_FLAGS = new Map([
+  ["-D", "dev"],
+  ["--save-dev", "dev"],
+  ["--dev", "dev"],
+  ["-E", "exact"],
+  ["--save-exact", "exact"],
+  ["--exact", "exact"]
+]);
+var DIR_FLAGS = new Set(["--cwd", "-C", "--dir", "--prefix"]);
+var VALUE_FLAGS2 = new Set([...DIR_FLAGS, "--filter", "-F"]);
+var PLAIN_WORD = /^[\w=@./:+-]+$/;
+function actions(byAction) {
+  return new Map(Object.entries(byAction).flatMap(([action, names]) => names.map((name) => [name, action])));
+}
+function isManager(program) {
+  return Object.hasOwn(ACTIONS, program);
+}
+function translate(from, to, subcommand, rest) {
+  const packages = rest.filter((arg) => !arg.startsWith("-"));
+  const flags = rest.filter((arg) => arg.startsWith("-"));
+  const listed = ACTIONS[from].get(subcommand);
+  const action = listed === "install" && packages.length > 0 ? "add" : listed;
+  const command = action ? COMMANDS[to][action] : undefined;
+  if (!action || command === undefined || !packages.every((name) => PLAIN_WORD.test(name)))
+    return null;
+  const options = [];
+  for (const flag of flags) {
+    const option = OPTION_FLAGS.get(flag) ?? (from === "bun" && flag === "-d" ? "dev" : undefined);
+    if (option === undefined || action !== "add")
+      return null;
+    options.push(OPTIONS[to][option]);
+  }
+  return [to, command, ...options, ...packages].join(" ");
+}
+function installRequests(command, cwd, home) {
+  const requests = [];
+  for (const piece of splitCommand(command)) {
+    const { program, args, assignments, isWrapped } = parseCommand(piece.command);
+    if (program === "cd" && args[0] !== undefined) {
+      cwd = resolvePath(cwd, args[0], home);
+      continue;
+    }
+    if (!isManager(program))
+      continue;
+    let dir = cwd;
+    let subcommand = "";
+    let rest = [];
+    let hasLeadingFlag = false;
+    for (let i = 0;i < args.length; i++) {
+      const arg = args[i] ?? "";
+      const [flag = "", value] = arg.split("=", 2);
+      if (DIR_FLAGS.has(flag) && value !== undefined && value !== "") {
+        dir = resolvePath(cwd, value, home);
+      } else if (VALUE_FLAGS2.has(arg)) {
+        if (DIR_FLAGS.has(arg) && args[i + 1] !== undefined)
+          dir = resolvePath(cwd, args[i + 1] ?? "", home);
+        i++;
+      } else if (!arg.startsWith("-")) {
+        subcommand = arg;
+        rest = args.slice(i + 1);
+        break;
+      }
+      hasLeadingFlag = true;
+    }
+    if (ACTIONS[program].has(subcommand))
+      requests.push({ piece, program, subcommand, rest, dir, assignments, isRewritable: !hasLeadingFlag && !isWrapped && piece.command === piece.text });
+  }
+  return requests;
+}
+function mismatchFor(request, pinned) {
+  const { piece, program, subcommand, rest, isRewritable, assignments } = request;
+  if (!pinned || pinned.managers.has(program))
+    return null;
+  const expected = [...pinned.managers];
+  const only = expected.length === 1 ? expected[0] : undefined;
+  const canRewrite = only !== undefined && isRewritable && assignments.every((word) => PLAIN_WORD.test(word));
+  const translated = canRewrite ? translate(program, only, subcommand, rest) : null;
+  const leading = piece.text.slice(0, piece.text.length - piece.text.trimStart().length);
+  const trailing = piece.text.slice(piece.text.trimEnd().length);
+  return {
+    piece,
+    rewrite: translated === null ? null : `${leading}${[...assignments, translated].join(" ")}${trailing}`,
+    reason: `${pinned.dir} is pinned to ${expected.join(" or ")} by its lockfile, so \`${`${program} ${subcommand}`.trim()}\` would install with the wrong package manager.`
+  };
+}
+
+// src/git.ts
+var GLOBAL_VALUE_OPTIONS = new Set(["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path", "--config-env"]);
+var READ_ONLY_STASH = new Set(["list", "show"]);
+var WHOLE_TREE = new Set(["-A", "--all", "-u", "--update", "--no-ignore-removal", ".", "./", ":/", "*"]);
+var COMMIT_VALUE_SHORTS = new Set(["m", "F", "c", "C", "t"]);
+var COMMIT_VALUE_LONGS = new Set(["--message", "--file", "--reuse-message", "--reedit-message", "--template", "--author", "--date", "--fixup", "--squash", "--cleanup", "--trailer", "--pathspec-from-file"]);
+var SHORT_CLUSTER = /^-[A-Z]+$/i;
+var STAGES_ALL = /[Au]/;
+var ALL_TAGS = new Set(["--tags", "--follow-tags"]);
+var STAGE_BY_PATH = `Stage by path: the tree carries unrelated work and peer sessions edit it live. ${USE_GC}`;
+var STASH = "Never `git stash`: a pop with nothing saved applies someone else's old stash. To see how a test behaves without your change, run it at HEAD with `base -- <cmd>` (a temporary worktree, the working tree untouched), `--keep <path>` to carry the new test over, `--ref <rev>` for another commit.";
+var ADD_ALL = `\`git add\` over the whole tree is refused. ${STAGE_BY_PATH}`;
+var COMMIT_ALL = `\`git commit -a\` stages the whole tree and is refused. ${STAGE_BY_PATH}`;
+var PUSH = "`git push` runs only when the user asked for a push in their latest prompt: say the commit is ready and let them ask.";
+var TAGS_APART = "A tag goes out with its branch in one `git push --atomic origin <branch> <tag>`, never a separate `git push --tags`.";
+function subcommandOf(args) {
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i] ?? "";
+    if (GLOBAL_VALUE_OPTIONS.has(arg))
+      i++;
+    else if (!arg.startsWith("-"))
+      return { name: arg, rest: args.slice(i + 1) };
+  }
+  return { name: "", rest: [] };
+}
+function commitsAll(args) {
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i] ?? "";
+    if (arg === "--")
+      return false;
+    if (arg === "--all")
+      return true;
+    if (COMMIT_VALUE_LONGS.has(arg)) {
+      i++;
+      continue;
+    }
+    if (!SHORT_CLUSTER.test(arg))
+      continue;
+    for (const [index, flag] of [...arg.slice(1)].entries()) {
+      if (flag === "a")
+        return true;
+      if (!COMMIT_VALUE_SHORTS.has(flag))
+        continue;
+      if (index === arg.length - 2)
+        i++;
+      break;
+    }
+  }
+  return false;
+}
+function gitViolation(command, isPushAsked = false) {
+  for (const piece of splitCommand(command)) {
+    const { program, args } = parseCommand(piece.command);
+    if (program !== "git")
+      continue;
+    const { name, rest } = subcommandOf(args);
+    if (name === "stash" && !READ_ONLY_STASH.has(rest[0] ?? ""))
+      return STASH;
+    if (name === "add" && rest.some((arg) => WHOLE_TREE.has(arg) || SHORT_CLUSTER.test(arg) && STAGES_ALL.test(arg)))
+      return ADD_ALL;
+    if (name === "commit" && commitsAll(rest))
+      return COMMIT_ALL;
+    if (name === "push" && !isPushAsked)
+      return PUSH;
+    if (name === "push" && rest.some((arg) => ALL_TAGS.has(arg)) && !rest.includes("--atomic"))
+      return TAGS_APART;
+  }
+  return null;
+}
+
+// src/commit.ts
+var REUSES = new Set(["c", "C", "--reuse-message", "--reedit-message", "--fixup", "--squash"]);
+var TRAILER_FLAGS = new Set(["--signoff", "--trailer"]);
+var LONG_VALUE = /=(.*)/s;
+var CAT_OPENER = /^\$\(cat <<-?[ \t]*(['"]?)([\w-]+)\1/;
+var HEREDOC_OPENER = /<<-?[ \t]*(['"]?)([\w-]+)\1/;
+var CAT_CLOSER = /^\s*(?:\)\s*)?$/;
+var EXPANDS = /\$[({\w]|`/;
+function heredocBody(text, opener) {
+  const found = opener.exec(text);
+  const newline = found === null ? -1 : text.indexOf(`
+`, found.index + found[0].length);
+  if (found === null || newline === -1)
+    return;
+  const lines = text.slice(newline + 1).split(`
+`);
+  const end = lines.findIndex((line) => line.trim() === found[2] || line.trim() === `${found[2]})`);
+  return end === -1 ? undefined : { body: lines.slice(0, end).join(`
+`), rest: lines.slice(end + 1).join(`
+`) };
+}
+function sourceOf(args, text) {
+  const source = { parts: [], file: null, stdin: null, isReused: false, hasTrailerFlag: false };
+  const take = (option, value) => {
+    if (option === "m" || option === "--message")
+      source.parts.push(value);
+    if (option === "F" || option === "--file")
+      source.file = value;
+    if (REUSES.has(option))
+      source.isReused = true;
+    if (option === "--trailer")
+      source.hasTrailerFlag = true;
+  };
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i] ?? "";
+    if (arg === "--")
+      break;
+    if (arg.startsWith("--")) {
+      const [option = "", value] = arg.split(LONG_VALUE);
+      if (TRAILER_FLAGS.has(option))
+        source.hasTrailerFlag = true;
+      if (REUSES.has(option))
+        source.isReused = true;
+      if (value !== undefined)
+        take(option, value);
+      else if (COMMIT_VALUE_LONGS.has(option))
+        take(option, args[++i] ?? "");
+      continue;
+    }
+    if (!SHORT_CLUSTER.test(arg))
+      continue;
+    for (const [index, flag] of [...arg.slice(1)].entries()) {
+      if (flag === "s")
+        source.hasTrailerFlag = true;
+      if (!COMMIT_VALUE_SHORTS.has(flag))
+        continue;
+      take(flag, index === arg.length - 2 ? args[++i] ?? "" : arg.slice(index + 2));
+      break;
+    }
+  }
+  if (source.file === "-")
+    source.stdin = heredocBody(text, HEREDOC_OPENER)?.body ?? null;
+  return source;
+}
+function commitSources(command) {
+  const sources = [];
+  for (const piece of splitCommand(command)) {
+    const { program, args } = parseCommand(piece.command);
+    const { name, rest } = program === "git" ? subcommandOf(args) : { name: "", rest: [] };
+    if (name === "commit")
+      sources.push(sourceOf(rest, piece.text));
+  }
+  return sources;
+}
+function inlineMessage(parts) {
+  const texts = [];
+  for (const part of parts) {
+    const found = heredocBody(part, CAT_OPENER);
+    const body = found !== undefined && CAT_CLOSER.test(found.rest) ? found.body : undefined;
+    if (body === undefined && EXPANDS.test(part))
+      return null;
+    texts.push(body ?? part);
+  }
+  return texts.join(`
+
+`);
+}
+
+// src/remote.ts
+var SHELL_PROGRAMS = new Set(["ssh", "scp", "sftp", "mosh", "autossh"]);
+var RSYNC_REMOTE = /^(?:[\w.-]+@)?[\w.-]{2,}:/;
+var SSH_URL = /^ssh:\/\//;
+var REMOTE = "Remote servers are off limits (no SSH, no deploys, no remote commands). Hand the user the exact command to run themselves.";
+function isRemote(text) {
+  const { program, args, assignments } = parseCommand(text);
+  if (SHELL_PROGRAMS.has(program))
+    return true;
+  if (program === "rsync")
+    return args.some((arg) => !arg.startsWith("-") && RSYNC_REMOTE.test(arg));
+  if (assignments.some((assignment) => assignment.startsWith("DOCKER_HOST=") && SSH_URL.test(assignment.slice("DOCKER_HOST=".length))))
+    return true;
+  return program === "docker" && tokenize(text).some((word) => SSH_URL.test(word));
+}
+function remoteViolation(command) {
+  return splitCommand(command).some((piece) => isRemote(piece.command)) ? REMOTE : null;
+}
+
+// src/replace.ts
+var PYTHON = /^python[\d.]*$/;
+var SCRIPT_RUNNERS = new Set(["bun", "node"]);
+var EVAL_FLAGS = new Set(["-e", "--eval", "-p", "--print"]);
+var WRITES = /\bwrite_text\(|\bBun\.write\(|\bwriteFileSync\(|\bwriteFile\(|\bopen\([^)\n]*,\s*['"](?:w|a|r\+)/;
+var REPLACE_CALL = /\.(replace|replaceAll)\(/g;
+var FILE_CALL = /\b(?:Path|open|Bun\.file|Bun\.write|readFileSync|writeFileSync|readFile|writeFile)\(\s*/g;
+var IDENTIFIER = /^[A-Z_$][\w$]*/i;
+var COUNT_CHECK = /\.count\(/g;
+var COUNT_EQUALS = /^\s*\)\s*==\s*(\d+)/;
+var PYTHON_COUNT = /^\s*,\s*(\d+)\s*\)/;
+var SPACE2 = /^\s*/;
+var COMMA = /^\s*,\s*/;
+var REGEX_FLAGS = /^[gm]*$/;
+var PLAIN_WORD2 = /^[\w@%+=:,./*?-]+$/;
+var SED_SEPARATORS = /^[\s;]*/;
+var SED_SEPARATOR = /[\s;]/;
+var BRE_ESCAPED = new Map([["(", "("], [")", ")"], ["{", "{"], ["}", "}"], ["+", "+"], ["?", "?"], ["|", "|"]]);
+var POSIX_CLASSES = new Map([["[:space:]", String.raw`\s`], ["[:digit:]", String.raw`\d`], ["[:alpha:]", "a-zA-Z"], ["[:alnum:]", "a-zA-Z0-9"], ["[:upper:]", "A-Z"], ["[:lower:]", "a-z"], ["[:blank:]", String.raw` \t`]]);
+var ESCAPES = new Map([["n", `
+`], ["t", "\t"]]);
+var BRE_METAS = new Set([".", "[", "]", "*", "^", "$"]);
+var ERE_METAS = new Set([...BRE_METAS, "+", "?", "(", ")", "{", "}", "|"]);
+var JS_SPECIALS = /[.*+?^${}()|[\]\\]/g;
+var WHY = "writes nothing unless each file matches as often as expected, where it rewrites files whatever it matched";
+var GENERIC = "Run `sub --from <text> --to <text> <file>...` instead (`--regex`, `--all`, `-n N`, `--pairs -` for several in order, `--dry-run --diff` to look first).";
+function literalAt(text, at, regex = false) {
+  let start = at;
+  const isRaw = text[start] === "r" || text[start] === "R";
+  if (isRaw || text[start] === "b")
+    start++;
+  const quote = text[start] ?? "";
+  if (regex && quote === "/")
+    return regexAt(text, start);
+  if (quote !== "'" && quote !== '"' && quote !== "`")
+    return;
+  const fence = text.startsWith(quote.repeat(3), start) ? quote.repeat(3) : quote;
+  let value = "";
+  for (let i = start + fence.length;i < text.length; i++) {
+    const char = text[i] ?? "";
+    if (text.startsWith(fence, i))
+      return { value, end: i + fence.length };
+    if (quote === "`" && text.startsWith("${", i))
+      return;
+    if (char === "\\" && !isRaw) {
+      const next = text[++i] ?? "";
+      value += ESCAPES.get(next) ?? (next === `
+` ? "" : next);
+    } else {
+      value += char;
+    }
+  }
+  return;
+}
+function regexAt(text, start) {
+  let source = "";
+  let inClass = false;
+  for (let i = start + 1;i < text.length; i++) {
+    const char = text[i] ?? "";
+    if (char === `
+`)
+      return;
+    if (char === "\\") {
+      source += char + (text[++i] ?? "");
+      continue;
+    }
+    if (char === "/" && !inClass) {
+      const flags = IDENTIFIER.exec(text.slice(i + 1))?.[0] ?? "";
+      return { value: source, end: i + 1 + flags.length, flags };
+    }
+    if (char === "[" || char === "]")
+      inClass = char === "[";
+    source += char;
+  }
+  return;
+}
+function skip(text, at, pattern) {
+  const found = pattern.exec(text.slice(at));
+  return found === null ? undefined : at + found[0].length;
+}
+function valueAt(script, at, regex = false) {
+  const literal = literalAt(script, at, regex);
+  const name = literal === undefined ? IDENTIFIER.exec(script.slice(at))?.[0] : undefined;
+  if (literal !== undefined || name === undefined)
+    return literal;
+  const assignments = [...script.slice(0, at).matchAll(new RegExp(String.raw`(?<![\w.$])${name.replaceAll("$", String.raw`\$`)}\s*=(?!=)\s*`, "g"))];
+  const last = assignments.at(-1);
+  const assigned = last === undefined ? undefined : literalAt(script, last.index + last[0].length, regex);
+  return assigned === undefined ? undefined : { ...assigned, end: at + name.length };
+}
+function scriptPaths(script) {
+  const paths = new Set;
+  for (const call of script.matchAll(FILE_CALL)) {
+    const path = valueAt(script, call.index + call[0].length)?.value;
+    if (path !== undefined && path !== "")
+      paths.add(path);
+  }
+  return [...paths];
+}
+function assertedCounts(script) {
+  const counts = new Map;
+  for (const call of script.matchAll(COUNT_CHECK)) {
+    const text = valueAt(script, call.index + call[0].length);
+    const equals = text === undefined ? null : COUNT_EQUALS.exec(script.slice(text.end));
+    if (text !== undefined && equals !== null)
+      counts.set(text.value, Number(equals[1]));
+  }
+  return counts;
+}
+function scriptPairs(script, isPython) {
+  const pairs = [];
+  const counts = isPython ? assertedCounts(script) : new Map;
+  for (const call of script.matchAll(REPLACE_CALL)) {
+    const from = valueAt(script, skip(script, call.index + call[0].length, SPACE2) ?? 0, !isPython);
+    const comma = from === undefined ? undefined : skip(script, from.end, COMMA);
+    const to = comma === undefined ? undefined : valueAt(script, comma);
+    if (from === undefined || to === undefined)
+      return;
+    if (from.flags !== undefined) {
+      if (!REGEX_FLAGS.test(from.flags))
+        return;
+      pairs.push({ from: from.value, to: to.value, regex: true, ...from.flags.includes("g") ? { all: true } : {} });
+      continue;
+    }
+    const limit = isPython ? PYTHON_COUNT.exec(script.slice(to.end)) : null;
+    const count = limit === null ? counts.get(from.value) : Number(limit[1]);
+    const all = call[1] === "replaceAll" || isPython && count === undefined;
+    const pair = { from: from.value, to: to.value };
+    if (all)
+      pair.all = true;
+    else if (count !== undefined && count !== 1)
+      pair.count = count;
+    pairs.push(pair);
+  }
+  return pairs.length === 0 ? undefined : pairs;
+}
+function sedArgs(args) {
+  const sed = { scripts: [], files: [], isExtended: false, isInPlace: false, isPlain: true };
+  const operands = [];
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i] ?? "";
+    if (arg === "--in-place" || arg.startsWith("--in-place="))
+      sed.isInPlace = true;
+    else if (arg === "--regexp-extended")
+      sed.isExtended = true;
+    else if (arg === "--expression")
+      sed.scripts.push(args[++i] ?? "");
+    else if (arg.startsWith("--expression="))
+      sed.scripts.push(arg.slice("--expression=".length));
+    else if (arg.startsWith("--"))
+      sed.isPlain = false;
+    else if (arg.startsWith("-") && arg.length > 1)
+      i += sedCluster(arg, args[i + 1], sed);
+    else
+      operands.push(arg);
+  }
+  if (sed.scripts.length === 0)
+    sed.scripts.push(operands.shift() ?? "");
+  sed.files = operands;
+  return sed;
+}
+function sedCluster(arg, next, sed) {
+  for (const [index, flag] of [...arg.slice(1)].entries()) {
+    if (flag === "i") {
+      sed.isInPlace = true;
+      return 0;
+    }
+    if (flag === "E" || flag === "r") {
+      sed.isExtended = true;
+    } else if (flag === "e") {
+      const value = index === arg.length - 2 ? next : arg.slice(index + 2);
+      sed.scripts.push(value ?? "");
+      return index === arg.length - 2 ? 1 : 0;
+    } else if (flag !== "s" && flag !== "u") {
+      sed.isPlain = false;
+    }
+  }
+  return 0;
+}
+function sedPart(script, at, delimiter) {
+  for (let i = at;i < script.length; i++) {
+    if (script[i] === "\\")
+      i++;
+    else if (script[i] === delimiter)
+      return { part: script.slice(at, i), end: i + 1 };
+  }
+  return;
+}
+function sedLiteral(pattern, delimiter, metas) {
+  let text = "";
+  for (let i = 0;i < pattern.length; i++) {
+    const char = pattern[i] ?? "";
+    if (char !== "\\") {
+      if (metas.has(char))
+        return;
+      text += char;
+      continue;
+    }
+    const next = pattern[++i] ?? "";
+    if (ESCAPES.has(next))
+      text += ESCAPES.get(next);
+    else if (next === delimiter || next === "\\" || BRE_METAS.has(next) || metas === ERE_METAS && ERE_METAS.has(next))
+      text += next;
+    else
+      return;
+  }
+  return text;
+}
+function sedRegex(pattern, delimiter, isExtended) {
+  let source = "";
+  for (let i = 0;i < pattern.length; i++) {
+    const char = pattern[i] ?? "";
+    const posix = [...POSIX_CLASSES].find(([name]) => pattern.startsWith(name, i));
+    if (posix !== undefined) {
+      source += posix[1];
+      i += posix[0].length - 1;
+    } else if (char === "\\") {
+      const next = pattern[++i] ?? "";
+      if (next === delimiter)
+        source += next.replaceAll(JS_SPECIALS, String.raw`\$&`);
+      else
+        source += !isExtended && BRE_ESCAPED.has(next) ? next : `\\${next}`;
+    } else {
+      source += !isExtended && BRE_ESCAPED.has(char) ? `\\${char}` : char;
+    }
+  }
+  return source;
+}
+function sedReplacement(replacement, literal) {
+  let text = "";
+  for (let i = 0;i < replacement.length; i++) {
+    const char = replacement[i] ?? "";
+    if (char === "&") {
+      text += literal ?? "$&";
+    } else if (char === "$" && literal === undefined) {
+      text += "$$";
+    } else if (char === "\\") {
+      const next = replacement[++i] ?? "";
+      if (next >= "1" && next <= "9" && literal === undefined)
+        text += `$${next}`;
+      else if (next >= "0" && next <= "9")
+        return;
+      else
+        text += ESCAPES.get(next) ?? (next === "$" && literal === undefined ? "$$" : next);
+    } else {
+      text += char;
+    }
+  }
+  return text;
+}
+function sedPairs(script, isExtended) {
+  const pairs = [];
+  for (let at = 0;at < script.length; ) {
+    at = skip(script, at, SED_SEPARATORS) ?? at;
+    if (at >= script.length)
+      break;
+    const delimiter = script[at + 1] ?? "";
+    if (script[at] !== "s" || delimiter === "" || delimiter === "\\" || delimiter === `
+`)
+      return;
+    const pattern = sedPart(script, at + 2, delimiter);
+    const replacement = pattern === undefined ? undefined : sedPart(script, pattern.end, delimiter);
+    if (pattern === undefined || replacement === undefined)
+      return;
+    const isGlobal = script[replacement.end] === "g";
+    at = replacement.end + (isGlobal ? 1 : 0);
+    if (at < script.length && !SED_SEPARATOR.test(script[at] ?? ""))
+      return;
+    const literal = sedLiteral(pattern.part, delimiter, isExtended ? ERE_METAS : BRE_METAS);
+    const to = sedReplacement(replacement.part, literal);
+    if (to === undefined)
+      return;
+    pairs.push({ from: literal ?? sedRegex(pattern.part, delimiter, isExtended), to, ...literal === undefined ? { regex: true } : {}, ...isGlobal ? { all: true } : {} });
+  }
+  return pairs.length === 0 ? undefined : pairs;
+}
+function quote(text) {
+  return `'${text.replaceAll("'", String.raw`'\''`)}'`;
+}
+function fileWord(path) {
+  return PLAIN_WORD2.test(path) ? path : quote(path);
+}
+function subCommand(pairs, files) {
+  const targets = files.length === 0 ? "<file>" : files.map(fileWord).join(" ");
+  const [pair] = pairs;
+  if (pairs.length > 1 || pair === undefined)
+    return `sub --pairs - ${targets} <<'PAIRS'
+${JSON.stringify(pairs)}
+PAIRS`;
+  const flags = [pair.regex === true ? " --regex" : "", pair.all === true ? " --all" : "", pair.count === undefined ? "" : ` -n ${pair.count}`].join("");
+  return `sub --from ${quote(pair.from)} --to ${quote(pair.to)}${flags} ${targets}`;
+}
+function route(what, pairs, files) {
+  return pairs === undefined ? `${what} ${GENERIC}` : `${what} Run this instead, which ${WHY}:
+${subCommand(pairs, files)}`;
+}
+function inlineScript(program, args, text) {
+  const flags = PYTHON.test(program) ? new Set(["-c"]) : EVAL_FLAGS;
+  const flag = args.findIndex((arg) => flags.has(arg));
+  if (flag !== -1)
+    return args[flag + 1] ?? null;
+  const reads = args.every((arg) => arg === "-" || arg.startsWith("<<") || program === "bun" && arg === "run");
+  return reads ? heredocBody(text, HEREDOC_OPENER)?.body ?? null : null;
+}
+function replaceViolation(command) {
+  for (const piece of splitCommand(command)) {
+    const { program, args } = parseCommand(piece.command);
+    if (program === "sed") {
+      const sed = sedArgs(args);
+      if (sed.isInPlace)
+        return route("`sed -i` rewrites files without checking what it matched.", sed.isPlain && sed.scripts.length > 0 ? sedPairs(sed.scripts.join(`
+`), sed.isExtended) : undefined, sed.files);
+      continue;
+    }
+    const isPython = PYTHON.test(program);
+    const script = isPython || SCRIPT_RUNNERS.has(program) ? inlineScript(program, args, piece.text) : null;
+    if (script === null || !WRITES.test(script) || script.search(REPLACE_CALL) === -1)
+      continue;
+    const pairs = scriptPairs(script, isPython);
+    return route(`A ${isPython ? "python" : program} script replacing text in a file is what \`sub\` does with a match-count check.`, pairs, scriptPaths(script));
+  }
+  return null;
+}
+
+// src/check.ts
+function absolute(path, cwd) {
+  return path.startsWith("/") ? path : `${cwd}/${path}`;
+}
+function commitViolation(command, { cwd, read }) {
+  for (const source of commitSources(command)) {
+    if (source.hasTrailerFlag)
+      return TRAILERS;
+    if (source.isReused || source.file?.startsWith("/dev/") === true)
+      continue;
+    const { file } = source;
+    let message = source.stdin;
+    if (file === null)
+      message = inlineMessage(source.parts);
+    else if (file !== "-")
+      message = read(absolute(file, cwd));
+    const violation = message === null ? null : commitMessageViolation(message);
+    if (violation !== null)
+      return violation;
+  }
+  return null;
+}
+function pinnedManagers(start, exists) {
+  for (let dir = start;; dir = parentDir(dir)) {
+    const managers = new Set(LOCKFILES.filter(([file]) => exists(`${dir}/${file}`)).map(([, manager]) => manager));
+    if (managers.size > 0)
+      return { dir, managers };
+    if (dir === "/")
+      return null;
+  }
+}
+function commandsRun(command) {
+  return [command, ...substitutions(command).flatMap(commandsRun)];
+}
+function mismatches(command, { cwd, home, exists }) {
+  return installRequests(command, cwd, home).flatMap((request) => {
+    const mismatch = mismatchFor(request, pinnedManagers(request.dir, exists));
+    return mismatch === null ? [] : [mismatch];
+  });
+}
+async function checkCommand(command, context) {
+  const violations = [];
+  const notes = [];
+  const add = (rule, message) => {
+    if (message !== null)
+      violations.push({ rule, message });
+  };
+  const run = commandsRun(command);
+  const first = (messages) => messages.find((message) => message !== null) ?? null;
+  add("remote", first(run.map(remoteViolation)));
+  add("git", first(run.map((each) => gitViolation(each, context.isPushAsked))));
+  const commit = commitViolation(command, context);
+  add("commit", commit === null ? null : `${commit} ${USE_GC}`);
+  add("sql", first(await Promise.all(run.map(async (each) => sqlViolation(each, async (path) => Promise.resolve(context.read(absolute(path, context.cwd))))))));
+  add("env", touchesEnv(command) ? USE_EV : null);
+  add("edit", context.canSub ? first(run.map(replaceViolation)) : null);
+  const found = mismatches(command, context);
+  const refused = found.find((mismatch) => mismatch.rewrite === null || !context.canRewrite);
+  const rewrite = refused?.rewrite ?? null;
+  const route = rewrite === null ? "Run it with the pinned manager instead." : `Run \`${rewrite.trim()}\` instead.`;
+  add("package-manager", refused === undefined ? null : `${refused.reason} ${route}`);
+  let rewritten = command;
+  if (refused === undefined && found.length > 0) {
+    rewritten = replacePieces(command, new Map(found.map((mismatch) => [mismatch.piece, mismatch.rewrite ?? ""])));
+    notes.push(...found.map((mismatch) => `${mismatch.reason} It ran as \`${mismatch.rewrite?.trim()}\` instead.`));
+  }
+  if (context.canRewrite && context.canWrap && shouldWrap(rewritten))
+    rewritten = wrap(rewritten);
+  return { violations, command: violations.length > 0 ? command : rewritten, notes: violations.length > 0 ? [] : notes, packages: addedPackages(command) };
+}
+function checkPath(path) {
+  return isEnvFile(path) ? { rule: "env", message: USE_EV } : null;
+}
+
+// src/bins.ts
+var BINS = {
+  check: "`check`: runs the repo's check, typecheck, lint and test steps and prints only what failed, each full log saved to a file; validate a change with it rather than chaining the scripts (`--only lint,test`, `--list`).",
+  fix: "`fix`: runs the repo's fixers and formatters (its fix, lint:fix and format scripts, just fmt, go fmt, cargo fmt, ruff) and lists the files they changed.",
+  db: '`db "<sql>"`: one read-only statement against the Postgres in DATABASE_URL (`-e KEY` for another) or, without one, the compose project\'s running Postgres service (`-s <service>`, `-d <database>`), credentials never shown, a write printed for the user to run; `db tables`, `db describe <table>`, `db dbs`.',
+  ev: "`ev`: .env files read and edited with values masked (`ev list`, `ev get KEY`, `ev grep <regex>`, `ev show <rev>:<file>`, `ev set`, `ev diff`, `ev missing`); `ev audit [dir]` finds env files others can read or git tracks, and compose files writing secrets out.",
+  redact: "`redact`: masks secrets in piped output, `<cmd> | redact`.",
+  pkg: "`pkg <name>[@version]`: checks an npm package before it is added: whether the name exists or is a near miss of a popular one, the newest version at least two weeks old, licence, install scripts; `bun add`, `npm install`, `pnpm add` and `yarn add` run it first and are refused on what it flags. `pkg bump <@scope/lib> [version]` waits until the registry serves a release, then `bun add --exact`s it in every consumer under ~/Workspace (`--dry-run`), `pkg consumers <name>` lists them; use it instead of a `bun info` and sleep loop and a `bun add` per repo.",
+  stack: "`stack port <name>`: the port a service name always hashes to, for every host port a compose file publishes; `stack audit [dir]` cross-checks release.config.ts against its compose files.",
+  ft: "`ft`: Forgejo CI runs, logs and waits, releases, issue checklists and claims, in a repo whose origin is on Forgejo.",
+  sub: "`sub --from <text> --to <text> <file>...`: replaces text, writing nothing unless each match count is as expected (1, `-n N`, `--all`), `--regex`, `--pairs <json|->` for several in order, `--dry-run --diff`; use it instead of sed -i, a bun -e or python editor.",
+  base: "`base [--ref <rev>] [--keep <path>...] -- <cmd>`: runs a command at HEAD (or a ref) in a temporary worktree, removed afterwards, ignored env files and node_modules/vendor linked; use it instead of git stash to see whether a test fails without your change (`--keep` the new test).",
+  gst: "`gst [--log N]`: branch, upstream, changed counts and HEAD in one line, then the changed paths by staged, unstaged and untracked; use it instead of `git status --short` and `git log --oneline`.",
+  gc: "`gc <title> [-m <line>]... [--ticket <line>]... -- <path>...`: commits exactly those paths, refusing with nothing staged when the message breaks a commit rule, a path has no change or other files are already staged; use it instead of chaining git add, status and commit.",
+  waitfor: "`waitfor --file <log> --until <regex> [--fail <regex>]`, `--port <n>`, `--url <url>`, `--pid <n>` (`-t 5m`): waits until the line shows, the port listens, the URL answers 2xx or the process exits, exits 1 on a --fail line with the lines around it, 2 on a timeout with the last lines; `waitfor task <id>` waits for a background Bash task and prints its exit code, last lines and failure lines; use it instead of sleep and tail, `until ! pgrep -f` or polling loops.",
+  gl: "`gl ci [ref]` waits for the GitLab pipeline covering a commit and prints each failed job's tests (exit 0/1/2), `gl runs`, `gl logs <pipeline> [-j job] [--full]`; use it instead of `glab ci` or `glab api .../pipelines/<id>/jobs` polled in a sleep loop.",
+  out: "`out -- <cmd>`: folds long output, keeping the errors and saving the full log; run noisy builds, installs, tests and linters through it."
+};
+function binsSection(installed) {
+  const lines = Object.entries(BINS).filter(([bin]) => installed.has(bin)).map(([, line]) => `- ${line}`);
+  return lines.length === 0 ? undefined : `# Agent tools
+
+CLIs installed on this machine for you to use over hand-rolled equivalents, \`<bin> --help\` for the options:
+${lines.join(`
+`)}`;
+}
+
+// src/hook.ts
+var EVENTS = ["pre-tool-use", "user-prompt-submit", "session-start"];
+var PUSH_WORDS = /\b(?:push|pousse)/i;
+var SESSION_ID = /^[\w-]+$/;
+var FILE_TOOLS = new Set(["Read", "Edit", "Write"]);
+function pushFile(sessionId, { stateDir }) {
+  return sessionId !== undefined && SESSION_ID.test(sessionId) ? `${stateDir}/push-asked/${sessionId}` : null;
+}
+function deny(violations) {
+  if (violations.length === 0)
+    return null;
+  return { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: violations.map((each) => each.message).join(`
+
+`) } };
+}
+async function bashCall(command, input, machine) {
+  const file = pushFile(input.session_id, machine);
+  const cwd = input.cwd ?? machine.home;
+  const verdict = await checkCommand(command, {
+    cwd,
+    home: machine.home,
+    isPushAsked: file !== null && machine.exists(file),
+    canRewrite: false,
+    canWrap: false,
+    canSub: machine.has("sub"),
+    read: machine.read,
+    exists: machine.exists
+  });
+  if (verdict.violations.length > 0 || verdict.packages.length === 0 || !machine.has("pkg"))
+    return deny(verdict.violations);
+  const checked = await machine.run(["pkg", "check", ...verdict.packages], cwd);
+  return checked.code === 1 ? deny([{ rule: "pkg", message: `pkg refused what this adds, so it was not run:
+${checked.text.trim()}` }]) : null;
+}
+function preToolUse(input, machine) {
+  const { tool_name: tool, tool_input: given = {} } = input;
+  if (tool === "Bash" && typeof given.command === "string")
+    return bashCall(given.command, input, machine);
+  if (tool !== undefined && FILE_TOOLS.has(tool) && typeof given.file_path === "string")
+    return deny([checkPath(given.file_path)].filter((each) => each !== null));
+  return null;
+}
+function userPromptSubmit(input, machine) {
+  const file = pushFile(input.session_id, machine);
+  if (file !== null && PUSH_WORDS.test(input.prompt ?? ""))
+    machine.write(file, "");
+  else if (file !== null)
+    machine.remove(file);
+  return null;
+}
+function sessionStart(machine) {
+  const text = binsSection(new Set(Object.keys(BINS).filter(machine.has)));
+  return text === undefined ? null : { hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: text } };
+}
+async function hook(event, input, machine) {
+  if (event === "pre-tool-use")
+    return preToolUse(input, machine);
+  return event === "user-prompt-submit" ? userPromptSubmit(input, machine) : sessionStart(machine);
+}
+
+// src/cli.ts
+var checkUsage = `guard check [options] [<command> | -]
+
+Checks a shell command against the rules: remote machines, git (stash, whole-tree add and commit, push, tags), commit messages, SQL writes, env files, package managers and in-place edits (sed -i and replace scripts, pointed at sub).
+Prints each broken rule with the route to take instead and exits 1, prints nothing and exits 0 when the command is clean.
+The command is read from stdin with - or when none is given; a rule may rewrite it instead (the pinned package manager, a noisy run through out), printed as \`runs as: <command>\`.`;
+var checkOptions = {
+  json: jsonOption("{violations, command, notes, packages} for a hook"),
+  cwd: { type: "string", description: "the directory the command runs in (default: here)" },
+  "push-asked": { type: "boolean", description: "the user asked for a push, so git push may run" },
+  "no-wrap": { type: "boolean", description: "never route a noisy command through out" }
+};
+var pathUsage = `guard path [--json] <path>...
+
+Checks the paths a file tool would read, edit or write: env files are refused.`;
+var pathOptions = {
+  json: jsonOption("{violations} for a hook")
+};
+var hookUsage = `guard hook <${EVENTS.join("|")}>
+
+Answers a Claude Code hook: reads the event JSON on stdin and prints the reply JSON, nothing when the call goes ahead untouched.
+pre-tool-use refuses a Bash call breaking a rule, an install pkg refuses, and a Read, Edit or Write of an env file; user-prompt-submit remembers whether the prompt asked for a push; session-start lists the installed agent-tools bins.
+A failure exits 1, which Claude Code reports without blocking the call.`;
+function readText(path) {
+  try {
+    return readFileSync(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+function report(violations) {
+  for (const { rule, message } of violations)
+    console.log(`${rule}: ${message}`);
+}
+async function check(args) {
+  const parsed = parse(args, checkUsage, checkOptions);
+  const { values, positionals } = parsed;
+  if (positionals.length > 1)
+    fail(`give the command as one argument, quoted
+
+${checkUsage}`);
+  const given = positionals[0] ?? "-";
+  const command = given === "-" ? await readInput("-", { noStdin: "give the command, or pipe it on stdin" }) : given;
+  const context = {
+    cwd: values.cwd ?? process6.cwd(),
+    home: homedir(),
+    isPushAsked: values["push-asked"] === true,
+    canRewrite: true,
+    canWrap: values["no-wrap"] !== true && Bun.which("out") !== null,
+    canSub: Bun.which("sub") !== null,
+    read: readText,
+    exists: existsSync
+  };
+  const verdict = await checkCommand(command, context);
+  if (values.json === true)
+    console.log(JSON.stringify(verdict));
+  else
+    report(verdict.violations);
+  if (values.json !== true && verdict.command !== command)
+    console.log(`runs as: ${verdict.command}${verdict.notes.map((note) => `
+${note}`).join("")}`);
+  return verdict.violations.length > 0 ? 1 : 0;
+}
+function path(args) {
+  const parsed = parse(args, pathUsage, pathOptions);
+  if (parsed.positionals.length === 0)
+    fail(`give at least one path
+
+${pathUsage}`);
+  const violations = parsed.positionals.flatMap((each) => checkPath(each) ?? []);
+  if (parsed.values.json === true)
+    console.log(JSON.stringify({ violations }));
+  else
+    report(violations);
+  return violations.length > 0 ? 1 : 0;
+}
+function machine() {
+  const home = homedir();
+  return {
+    home,
+    stateDir: `${process6.env.XDG_STATE_HOME ?? `${home}/.local/state`}/guard`,
+    has: (bin) => Bun.which(bin) !== null,
+    run: async (argv, cwd) => runCommand(argv, { cwd }),
+    read: readText,
+    exists: existsSync,
+    write: (path, text) => {
+      mkdirSync(dirname(path), { recursive: true });
+      writeFileSync(path, text);
+    },
+    remove: (path) => rmSync(path, { force: true })
+  };
+}
+async function hookCommand(args) {
+  const parsed = parse(args, hookUsage, {});
+  const event = parsed.positionals[0] ?? "";
+  if (!EVENTS.includes(event))
+    fail(`unknown event ${event}
+
+${hookUsage}`, 1);
+  const reply = await hook(event, JSON.parse(await Bun.stdin.text()), machine());
+  if (reply !== null)
+    console.log(JSON.stringify(reply));
+  return 0;
+}
+process6.exitCode = await runCli({
+  name: "guard",
+  version,
+  about: "the safety rules a Claude Code Bash call is held to, each refusal naming the route",
+  commands: {
+    check: { run: check, summary: "check a shell command, printing each broken rule with its route" },
+    path: { run: async (args) => Promise.resolve(path(args)), summary: "check a path a file tool would open" },
+    hook: { run: hookCommand, summary: "answer a Claude Code hook event, JSON in and out" }
+  },
+  defaultCommand: "check"
+});