@outfitter/tooling 0.2.2 → 0.2.3

package/dist/cli/index.js

@@ -1,4 +1,10 @@
 #!/usr/bin/env bun
+import {
+  VERSION
+} from "../shared/chunk-8aenrm6f.js";
+import {
+  __require
+} from "../shared/chunk-3s189drz.js";
 
 // src/cli/index.ts
 import { Command } from "commander";
@@ -22,6 +28,561 @@ async function runCheck(paths = []) {
   process.exit(exitCode);
 }
 
+// src/cli/check-boundary-invocations.ts
+import { relative, resolve } from "node:path";
+var ROOT_RUNS_PACKAGE_SRC = /\bbun(?:x)?\s+(?:run\s+)?(?:\.\.\/|\.\/)?packages\/[^/\s]+\/src\/\S+/;
+var CD_PACKAGE_THEN_RUNS_SRC = /\bcd\s+(?:\.\.\/|\.\/)?packages\/[^/\s]+\s*&&\s*bun(?:x)?\s+(?:run\s+)?(?:\.\.\/|\.\/)?src\/\S+/;
+function detectBoundaryViolation(location) {
+  if (ROOT_RUNS_PACKAGE_SRC.test(location.command)) {
+    return { ...location, rule: "root-runs-package-src" };
+  }
+  if (CD_PACKAGE_THEN_RUNS_SRC.test(location.command)) {
+    return { ...location, rule: "cd-package-then-runs-src" };
+  }
+  return null;
+}
+function findBoundaryViolations(entries) {
+  const violations = [];
+  for (const entry of entries) {
+    for (const [scriptName, command] of Object.entries(entry.scripts)) {
+      const violation = detectBoundaryViolation({
+        file: entry.file,
+        scriptName,
+        command
+      });
+      if (violation) {
+        violations.push(violation);
+      }
+    }
+  }
+  return violations.sort((a, b) => {
+    const fileCompare = a.file.localeCompare(b.file);
+    if (fileCompare !== 0) {
+      return fileCompare;
+    }
+    return a.scriptName.localeCompare(b.scriptName);
+  });
+}
+async function readScriptEntries(cwd, options = {}) {
+  const entries = [];
+  const rootPackagePath = resolve(cwd, "package.json");
+  const candidatePaths = [rootPackagePath];
+  if (options.appManifestRelativePaths) {
+    for (const file of options.appManifestRelativePaths) {
+      candidatePaths.push(resolve(cwd, file));
+    }
+  } else {
+    const appPackageGlob = new Bun.Glob("apps/*/package.json");
+    for (const match of appPackageGlob.scanSync({ cwd })) {
+      candidatePaths.push(resolve(cwd, match));
+    }
+  }
+  const readPackageJson = options.readPackageJson ?? (async (filePath) => await Bun.file(filePath).json());
+  for (const filePath of candidatePaths) {
+    const isRootManifest = filePath === rootPackagePath;
+    try {
+      const pkg = await readPackageJson(filePath);
+      if (!pkg.scripts) {
+        continue;
+      }
+      entries.push({
+        file: relative(cwd, filePath),
+        scripts: pkg.scripts
+      });
+    } catch (error) {
+      if (isRootManifest) {
+        const message = error instanceof Error ? error.message : "unknown parse error";
+        throw new Error(`Failed to read root package manifest (${filePath}): ${message}`);
+      }
+    }
+  }
+  return entries;
+}
+async function runCheckBoundaryInvocations() {
+  const cwd = process.cwd();
+  let entries;
+  try {
+    entries = await readScriptEntries(cwd);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "unknown read failure";
+    process.stderr.write(`Boundary invocation check failed before evaluation: ${message}
+`);
+    process.exit(1);
+  }
+  const violations = findBoundaryViolations(entries);
+  if (violations.length === 0) {
+    process.stdout.write(`No boundary invocation violations detected in root/apps scripts.
+`);
+    process.exit(0);
+  }
+  process.stderr.write(`Boundary invocation violations detected:
+
+`);
+  for (const violation of violations) {
+    process.stderr.write(`- ${violation.file}#${violation.scriptName}: ${violation.command}
+`);
+  }
+  process.stderr.write("\nUse canonical command surfaces (e.g. `outfitter repo ...` or package bins) instead of executing packages/*/src directly.\n");
+  process.exit(1);
+}
+
+// src/cli/check-bunup-registry.ts
+import { resolve as resolve2 } from "node:path";
+function extractBunupFilterName(script) {
+  const match = script.match(/bunup\s+--filter\s+(\S+)/);
+  return match?.[1] ?? null;
+}
+function findUnregisteredPackages(packagesWithFilter, registeredNames) {
+  const registered = new Set(registeredNames);
+  const missing = packagesWithFilter.filter((name) => !registered.has(name)).sort();
+  return {
+    ok: missing.length === 0,
+    missing
+  };
+}
+var COLORS = {
+  reset: "\x1B[0m",
+  red: "\x1B[31m",
+  green: "\x1B[32m",
+  yellow: "\x1B[33m",
+  blue: "\x1B[34m",
+  dim: "\x1B[2m"
+};
+async function runCheckBunupRegistry() {
+  const cwd = process.cwd();
+  const configPath = resolve2(cwd, "bunup.config.ts");
+  let registeredNames;
+  try {
+    const configModule = await import(configPath);
+    const rawConfig = configModule.default;
+    if (!Array.isArray(rawConfig)) {
+      process.stderr.write(`bunup.config.ts must export a workspace array
+`);
+      process.exit(1);
+    }
+    registeredNames = rawConfig.map((entry) => entry.name);
+  } catch {
+    process.stderr.write(`Could not load bunup.config.ts from ${cwd}
+`);
+    process.exit(1);
+  }
+  const packagesWithFilter = [];
+  const glob = new Bun.Glob("{packages,apps}/*/package.json");
+  for (const match of glob.scanSync({ cwd })) {
+    const pkgPath = resolve2(cwd, match);
+    try {
+      const pkg = await Bun.file(pkgPath).json();
+      const buildScript = pkg.scripts?.["build"];
+      if (!buildScript)
+        continue;
+      const filterName = extractBunupFilterName(buildScript);
+      if (filterName) {
+        packagesWithFilter.push(filterName);
+      }
+    } catch {}
+  }
+  const result = findUnregisteredPackages(packagesWithFilter, registeredNames);
+  if (result.ok) {
+    process.stdout.write(`${COLORS.green}All ${packagesWithFilter.length} packages with bunup --filter are registered in bunup.config.ts.${COLORS.reset}
+`);
+    process.exit(0);
+  }
+  process.stderr.write(`${COLORS.red}${result.missing.length} package(s) have bunup --filter build scripts but are not registered in bunup.config.ts:${COLORS.reset}
+
+`);
+  for (const name of result.missing) {
+    process.stderr.write(`  ${COLORS.yellow}${name}${COLORS.reset}  ${COLORS.dim}(missing from workspace array)${COLORS.reset}
+`);
+  }
+  process.stderr.write(`
+Add the missing entries to ${COLORS.blue}bunup.config.ts${COLORS.reset} defineWorkspace array.
+`);
+  process.stderr.write(`Without registration, ${COLORS.dim}bunup --filter <name>${COLORS.reset} silently exits with no output.
+`);
+  process.exit(1);
+}
+
+// src/cli/check-changeset.ts
+function getChangedPackagePaths(files) {
+  const packageNames = new Set;
+  const pattern = /^packages\/([^/]+)\/src\//;
+  for (const file of files) {
+    const match = pattern.exec(file);
+    if (match?.[1]) {
+      packageNames.add(match[1]);
+    }
+  }
+  return [...packageNames].sort();
+}
+function getChangedChangesetFiles(files) {
+  const pattern = /^\.changeset\/([^/]+\.md)$/;
+  const results = [];
+  for (const file of files) {
+    const match = pattern.exec(file);
+    if (match?.[1] && match[1] !== "README.md") {
+      results.push(match[1]);
+    }
+  }
+  return results.sort();
+}
+function checkChangesetRequired(changedPackages, changesetFiles) {
+  if (changedPackages.length === 0) {
+    return { ok: true, missingFor: [] };
+  }
+  if (changesetFiles.length > 0) {
+    return { ok: true, missingFor: [] };
+  }
+  return { ok: false, missingFor: changedPackages };
+}
+var COLORS2 = {
+  reset: "\x1B[0m",
+  red: "\x1B[31m",
+  green: "\x1B[32m",
+  yellow: "\x1B[33m",
+  blue: "\x1B[34m",
+  dim: "\x1B[2m"
+};
+async function runCheckChangeset(options = {}) {
+  if (options.skip || process.env["NO_CHANGESET"] === "1") {
+    process.stdout.write(`${COLORS2.dim}check-changeset skipped (NO_CHANGESET=1)${COLORS2.reset}
+`);
+    process.exit(0);
+  }
+  if (process.env["GITHUB_EVENT_NAME"] === "push") {
+    process.stdout.write(`${COLORS2.dim}check-changeset skipped (push event)${COLORS2.reset}
+`);
+    process.exit(0);
+  }
+  const cwd = process.cwd();
+  let changedFiles;
+  try {
+    const proc = Bun.spawnSync(["git", "diff", "--name-only", "origin/main...HEAD"], { cwd });
+    if (proc.exitCode !== 0) {
+      process.exit(0);
+    }
+    changedFiles = proc.stdout.toString().trim().split(`
+`).filter((line) => line.length > 0);
+  } catch {
+    process.exit(0);
+  }
+  const changedPackages = getChangedPackagePaths(changedFiles);
+  if (changedPackages.length === 0) {
+    process.stdout.write(`${COLORS2.green}No package source changes detected.${COLORS2.reset}
+`);
+    process.exit(0);
+  }
+  const changesetFiles = getChangedChangesetFiles(changedFiles);
+  const check = checkChangesetRequired(changedPackages, changesetFiles);
+  if (check.ok) {
+    process.stdout.write(`${COLORS2.green}Changeset found for ${changedPackages.length} changed package(s).${COLORS2.reset}
+`);
+    process.exit(0);
+  }
+  process.stderr.write(`${COLORS2.red}Missing changeset!${COLORS2.reset}
+
+`);
+  process.stderr.write(`The following packages have source changes but no changeset:
+
+`);
+  for (const pkg of check.missingFor) {
+    process.stderr.write(`  ${COLORS2.yellow}@outfitter/${pkg}${COLORS2.reset}
+`);
+  }
+  process.stderr.write(`
+Run ${COLORS2.blue}bun run changeset${COLORS2.reset} to add a changeset, ` + `or add the ${COLORS2.blue}no-changeset${COLORS2.reset} label to skip.
+`);
+  process.exit(1);
+}
+
+// src/cli/check-clean-tree.ts
+function parseGitDiff(diffOutput) {
+  return diffOutput.split(`
+`).map((line) => line.trim()).filter(Boolean);
+}
+function parseUntrackedFiles(lsOutput) {
+  return lsOutput.split(`
+`).map((line) => line.trim()).filter(Boolean);
+}
+var COLORS3 = {
+  reset: "\x1B[0m",
+  red: "\x1B[31m",
+  green: "\x1B[32m",
+  dim: "\x1B[2m"
+};
+async function runCheckCleanTree(options = {}) {
+  const pathArgs = options.paths ?? [];
+  const diffResult = Bun.spawnSync(["git", "diff", "HEAD", "--name-only", "--", ...pathArgs], { stderr: "pipe" });
+  if (diffResult.exitCode !== 0) {
+    process.stderr.write(`Failed to run git diff
+`);
+    process.exit(1);
+  }
+  const modified = parseGitDiff(diffResult.stdout.toString());
+  const lsResult = Bun.spawnSync(["git", "ls-files", "--others", "--exclude-standard", "--", ...pathArgs], { stderr: "pipe" });
+  if (lsResult.exitCode !== 0) {
+    process.stderr.write(`Failed to run git ls-files
+`);
+    process.exit(1);
+  }
+  const untracked = parseUntrackedFiles(lsResult.stdout.toString());
+  const clean = modified.length === 0 && untracked.length === 0;
+  const status = { clean, modified, untracked };
+  if (status.clean) {
+    process.stdout.write(`${COLORS3.green}Working tree is clean.${COLORS3.reset}
+`);
+    process.exit(0);
+  }
+  process.stderr.write(`${COLORS3.red}Working tree is dirty after verification:${COLORS3.reset}
+
+`);
+  if (modified.length > 0) {
+    process.stderr.write(`Modified files:
+`);
+    for (const file of modified) {
+      process.stderr.write(`  ${COLORS3.dim}M${COLORS3.reset} ${file}
+`);
+    }
+  }
+  if (untracked.length > 0) {
+    process.stderr.write(`Untracked files:
+`);
+    for (const file of untracked) {
+      process.stderr.write(`  ${COLORS3.dim}?${COLORS3.reset} ${file}
+`);
+    }
+  }
+  process.stderr.write(`
+This likely means a build step produced uncommitted changes.
+`);
+  process.stderr.write(`Commit these changes or add them to .gitignore.
+`);
+  process.exit(1);
+}
+
+// src/cli/check-exports.ts
+import { resolve as resolve3 } from "node:path";
+function entryToSubpath(entry) {
+  const stripped = entry.replace(/^src\//, "").replace(/\.[cm]?[jt]sx?$/, "");
+  if (stripped === "index") {
+    return ".";
+  }
+  if (stripped.endsWith("/index")) {
+    return `./${stripped.slice(0, -"/index".length)}`;
+  }
+  return `./${stripped}`;
+}
+function compareExports(input) {
+  const { name, actual, expected, path } = input;
+  const actualKeys = new Set(Object.keys(actual));
+  const expectedKeys = new Set(Object.keys(expected));
+  const added = [];
+  const removed = [];
+  const changed = [];
+  for (const key of expectedKeys) {
+    if (!actualKeys.has(key)) {
+      added.push(key);
+    }
+  }
+  for (const key of actualKeys) {
+    if (!expectedKeys.has(key)) {
+      removed.push(key);
+    }
+  }
+  for (const key of actualKeys) {
+    if (expectedKeys.has(key)) {
+      const actualValue = actual[key];
+      const expectedValue = expected[key];
+      if (JSON.stringify(actualValue) !== JSON.stringify(expectedValue)) {
+        changed.push({ key, expected: expectedValue, actual: actualValue });
+      }
+    }
+  }
+  added.sort();
+  removed.sort();
+  changed.sort((a, b) => a.key.localeCompare(b.key));
+  if (added.length === 0 && removed.length === 0 && changed.length === 0) {
+    return { name, status: "ok" };
+  }
+  return {
+    name,
+    status: "drift",
+    drift: {
+      package: name,
+      path: path ?? "",
+      added,
+      removed,
+      changed
+    }
+  };
+}
+function matchesExclude(subpath, excludes) {
+  return excludes.some((pattern) => new Bun.Glob(pattern).match(subpath));
+}
+var CLI_EXCLUSION_PATTERNS = [
+  "**/cli.ts",
+  "**/cli/index.ts",
+  "**/bin.ts",
+  "**/bin/index.ts"
+];
+function isCliEntrypoint(entry) {
+  return CLI_EXCLUSION_PATTERNS.some((pattern) => new Bun.Glob(pattern).match(entry));
+}
+function buildExportValue(entry) {
+  const distPath = entry.replace(/^src\//, "").replace(/\.[cm]?[jt]sx?$/, "");
+  return {
+    import: {
+      types: `./dist/${distPath}.d.ts`,
+      default: `./dist/${distPath}.js`
+    }
+  };
+}
+function discoverEntries(packageRoot) {
+  const glob = new Bun.Glob("src/**/*.ts");
+  const entries = [];
+  for (const match of glob.scanSync({ cwd: packageRoot, dot: false })) {
+    if (match.includes("__tests__") || match.endsWith(".test.ts")) {
+      continue;
+    }
+    entries.push(match);
+  }
+  return entries.sort();
+}
+function addConfigFileExports(expected, pkg) {
+  const CONFIG_RE = /\.(json|jsonc|yml|yaml|toml)$/;
+  const configFiles = (pkg.files ?? []).filter((file) => CONFIG_RE.test(file) && file !== "package.json");
+  for (const file of configFiles) {
+    expected[`./${file}`] = `./${file}`;
+    let base = file.replace(CONFIG_RE, "");
+    const match = base.match(/^(.+)\.preset(?:\.(.+))?$/);
+    if (match?.[1]) {
+      base = match[2] ? `${match[1]}-${match[2]}` : match[1];
+    }
+    if (base !== file) {
+      expected[`./${base}`] = `./${file}`;
+    }
+  }
+}
+function computeExpectedExports(packageRoot, workspace, pkg) {
+  const entries = discoverEntries(packageRoot);
+  const exportsConfig = typeof workspace.config?.exports === "object" ? workspace.config.exports : undefined;
+  const excludes = exportsConfig?.exclude ?? [];
+  const customExports = exportsConfig?.customExports ?? {};
+  const expected = {};
+  const subpathEntries = new Map;
+  for (const entry of entries) {
+    if (isCliEntrypoint(entry))
+      continue;
+    const subpath = entryToSubpath(entry);
+    if (matchesExclude(subpath, excludes))
+      continue;
+    const existing = subpathEntries.get(subpath);
+    if (existing) {
+      if (!existing.endsWith("/index.ts") && entry.endsWith("/index.ts")) {
+        continue;
+      }
+    }
+    subpathEntries.set(subpath, entry);
+  }
+  for (const [subpath, entry] of subpathEntries) {
+    expected[subpath] = buildExportValue(entry);
+  }
+  for (const [key, value] of Object.entries(customExports)) {
+    expected[`./${key.replace(/^\.\//, "")}`] = value;
+  }
+  addConfigFileExports(expected, pkg);
+  expected["./package.json"] = "./package.json";
+  return expected;
+}
+var COLORS4 = {
+  reset: "\x1B[0m",
+  red: "\x1B[31m",
+  green: "\x1B[32m",
+  yellow: "\x1B[33m",
+  blue: "\x1B[34m",
+  dim: "\x1B[2m"
+};
+async function runCheckExports(options = {}) {
+  const cwd = process.cwd();
+  const configPath = resolve3(cwd, "bunup.config.ts");
+  let workspaces;
+  try {
+    const configModule = await import(configPath);
+    const rawConfig = configModule.default;
+    if (!Array.isArray(rawConfig)) {
+      process.stderr.write(`bunup.config.ts must export a workspace array
+`);
+      process.exit(1);
+    }
+    workspaces = rawConfig;
+  } catch {
+    process.stderr.write(`Could not load bunup.config.ts from ${cwd}
+`);
+    process.exit(1);
+  }
+  const results = [];
+  for (const workspace of workspaces) {
+    const packageRoot = resolve3(cwd, workspace.root);
+    const pkgPath = resolve3(packageRoot, "package.json");
+    let pkg;
+    try {
+      pkg = await Bun.file(pkgPath).json();
+    } catch {
+      results.push({ name: workspace.name, status: "ok" });
+      continue;
+    }
+    const actual = typeof pkg.exports === "object" && pkg.exports !== null ? pkg.exports : {};
+    const expected = computeExpectedExports(packageRoot, workspace, pkg);
+    results.push(compareExports({
+      name: workspace.name,
+      actual,
+      expected,
+      path: workspace.root
+    }));
+  }
+  const checkResult = {
+    ok: results.every((r) => r.status === "ok"),
+    packages: results
+  };
+  if (options.json) {
+    process.stdout.write(`${JSON.stringify(checkResult, null, 2)}
+`);
+  } else {
+    const drifted = results.filter((r) => r.status === "drift");
+    if (drifted.length === 0) {
+      process.stdout.write(`${COLORS4.green}All ${results.length} packages have exports in sync.${COLORS4.reset}
+`);
+    } else {
+      process.stderr.write(`${COLORS4.red}Export drift detected in ${drifted.length} package(s):${COLORS4.reset}
+
+`);
+      for (const result of drifted) {
+        const drift = result.drift;
+        if (!drift)
+          continue;
+        process.stderr.write(`  ${COLORS4.yellow}${result.name}${COLORS4.reset} ${COLORS4.dim}(${drift.path})${COLORS4.reset}
+`);
+        for (const key of drift.added) {
+          process.stderr.write(`    ${COLORS4.green}+ ${key}${COLORS4.reset}  ${COLORS4.dim}(missing from package.json)${COLORS4.reset}
+`);
+        }
+        for (const key of drift.removed) {
+          process.stderr.write(`    ${COLORS4.red}- ${key}${COLORS4.reset}  ${COLORS4.dim}(not in source)${COLORS4.reset}
+`);
+        }
+        for (const entry of drift.changed) {
+          process.stderr.write(`    ${COLORS4.yellow}~ ${entry.key}${COLORS4.reset}  ${COLORS4.dim}(value mismatch)${COLORS4.reset}
+`);
+        }
+        process.stderr.write(`
+`);
+      }
+      process.stderr.write(`Run ${COLORS4.blue}bun run build${COLORS4.reset} to regenerate exports.
+`);
+    }
+  }
+  process.exit(checkResult.ok ? 0 : 1);
+}
+
 // src/cli/fix.ts
 function buildFixCommand(options) {
   const cmd = ["ultracite", "fix"];
@@ -110,7 +671,7 @@ async function runInit(cwd = process.cwd()) {
 // src/cli/pre-push.ts
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-var COLORS = {
+var COLORS5 = {
   reset: "\x1B[0m",
   red: "\x1B[31m",
   green: "\x1B[32m",
@@ -226,13 +787,13 @@ function getChangedFilesForPush() {
 function maybeSkipForRedPhase(reason, branch) {
   const changedFiles = getChangedFilesForPush();
   if (!changedFiles.deterministic) {
-    log(`${COLORS.yellow}RED-phase bypass denied${COLORS.reset}: could not determine full push diff range`);
+    log(`${COLORS5.yellow}RED-phase bypass denied${COLORS5.reset}: could not determine full push diff range`);
     log("Running strict verification.");
     log("");
     return false;
   }
   if (!canBypassRedPhaseByChangedFiles(changedFiles)) {
-    log(`${COLORS.yellow}RED-phase bypass denied${COLORS.reset}: changed files are not test-only`);
+    log(`${COLORS5.yellow}RED-phase bypass denied${COLORS5.reset}: changed files are not test-only`);
     if (changedFiles.files.length > 0) {
       log(`Changed files (${changedFiles.source}): ${changedFiles.files.join(", ")}`);
     } else {
@@ -242,11 +803,11 @@ function maybeSkipForRedPhase(reason, branch) {
     return false;
   }
   if (reason === "branch") {
-    log(`${COLORS.yellow}TDD RED phase${COLORS.reset} detected: ${COLORS.blue}${branch}${COLORS.reset}`);
+    log(`${COLORS5.yellow}TDD RED phase${COLORS5.reset} detected: ${COLORS5.blue}${branch}${COLORS5.reset}`);
   } else {
-    log(`${COLORS.yellow}Scaffold branch${COLORS.reset} with RED phase branch in context: ${COLORS.blue}${branch}${COLORS.reset}`);
+    log(`${COLORS5.yellow}Scaffold branch${COLORS5.reset} with RED phase branch in context: ${COLORS5.blue}${branch}${COLORS5.reset}`);
   }
-  log(`${COLORS.yellow}Skipping strict verification${COLORS.reset} - changed files are test-only`);
+  log(`${COLORS5.yellow}Skipping strict verification${COLORS5.reset} - changed files are test-only`);
   log(`Diff source: ${changedFiles.source}`);
   log("");
   log("Remember: GREEN phase (implementation) must make these tests pass!");
@@ -322,14 +883,14 @@ function readPackageScripts(cwd = process.cwd()) {
 }
 function runScript(scriptName) {
   log("");
-  log(`Running: ${COLORS.blue}bun run ${scriptName}${COLORS.reset}`);
+  log(`Running: ${COLORS5.blue}bun run ${scriptName}${COLORS5.reset}`);
   const result = Bun.spawnSync(["bun", "run", scriptName], {
     stdio: ["inherit", "inherit", "inherit"]
   });
   return result.exitCode === 0;
 }
 async function runPrePush(options = {}) {
-  log(`${COLORS.blue}Pre-push verify${COLORS.reset} (TDD-aware)`);
+  log(`${COLORS5.blue}Pre-push verify${COLORS5.reset} (TDD-aware)`);
   log("");
   const branch = getCurrentBranch();
   if (isRedPhaseBranch(branch)) {
@@ -345,12 +906,12 @@ async function runPrePush(options = {}) {
     }
   }
   if (options.force) {
-    log(`${COLORS.yellow}Force flag set${COLORS.reset} - skipping strict verification`);
+    log(`${COLORS5.yellow}Force flag set${COLORS5.reset} - skipping strict verification`);
     process.exit(0);
   }
   const plan = createVerificationPlan(readPackageScripts());
   if (!plan.ok) {
-    log(`${COLORS.red}Strict pre-push verification is not configured${COLORS.reset}`);
+    log(`${COLORS5.red}Strict pre-push verification is not configured${COLORS5.reset}`);
     log(plan.error);
     log("");
     log("Add one of:");
@@ -358,7 +919,7 @@ async function runPrePush(options = {}) {
     log("  - typecheck + (check or lint) + build + test");
     process.exit(1);
   }
-  log(`Running strict verification for branch: ${COLORS.blue}${branch}${COLORS.reset}`);
+  log(`Running strict verification for branch: ${COLORS5.blue}${branch}${COLORS5.reset}`);
   if (plan.source === "verify:ci") {
     log("Using `verify:ci` script.");
   } else {
@@ -369,7 +930,7 @@ async function runPrePush(options = {}) {
       continue;
     }
     log("");
-    log(`${COLORS.red}Verification failed${COLORS.reset} on script: ${scriptName}`);
+    log(`${COLORS5.red}Verification failed${COLORS5.reset} on script: ${scriptName}`);
     log("");
     log("If this is intentional TDD RED phase work, name your branch:");
     log("  - feature-tests");
@@ -378,14 +939,14 @@ async function runPrePush(options = {}) {
     process.exit(1);
   }
   log("");
-  log(`${COLORS.green}Strict verification passed${COLORS.reset}`);
+  log(`${COLORS5.green}Strict verification passed${COLORS5.reset}`);
   process.exit(0);
 }
 
 // src/cli/upgrade-bun.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync } from "node:fs";
 import { join as join2 } from "node:path";
-var COLORS2 = {
+var COLORS6 = {
   reset: "\x1B[0m",
   red: "\x1B[31m",
   green: "\x1B[32m",
@@ -397,15 +958,15 @@ function log2(msg) {
 `);
 }
 function info(msg) {
-  process.stdout.write(`${COLORS2.blue}▸${COLORS2.reset} ${msg}
+  process.stdout.write(`${COLORS6.blue}▸${COLORS6.reset} ${msg}
 `);
 }
 function success(msg) {
-  process.stdout.write(`${COLORS2.green}✓${COLORS2.reset} ${msg}
+  process.stdout.write(`${COLORS6.green}✓${COLORS6.reset} ${msg}
 `);
 }
 function warn(msg) {
-  process.stdout.write(`${COLORS2.yellow}!${COLORS2.reset} ${msg}
+  process.stdout.write(`${COLORS6.yellow}!${COLORS6.reset} ${msg}
 `);
 }
 async function fetchLatestVersion() {
@@ -528,7 +1089,7 @@ async function runUpgradeBun(targetVersion, options = {}) {
 
 // src/cli/index.ts
 var program = new Command;
-program.name("tooling").description("Dev tooling configuration management for Outfitter projects").version("0.1.0-rc.1");
+program.name("tooling").description("Dev tooling configuration management for Outfitter projects").version(VERSION);
 program.command("init").description("Initialize tooling config in the current project").action(async () => {
   await runInit();
 });
@@ -544,4 +1105,23 @@ program.command("upgrade-bun").description("Upgrade Bun version across the proje
 program.command("pre-push").description("TDD-aware pre-push strict verification hook").option("-f, --force", "Skip strict verification entirely").action(async (options) => {
   await runPrePush(options);
 });
+program.command("check-bunup-registry").description("Validate packages with bunup --filter are registered in bunup.config.ts").action(async () => {
+  await runCheckBunupRegistry();
+});
+program.command("check-changeset").description("Validate PRs touching package source include a changeset").option("-s, --skip", "Skip changeset check").action(async (options) => {
+  await runCheckChangeset(options);
+});
+program.command("check-exports").description("Validate package.json exports match source entry points").option("--json", "Output results as JSON").action(async (options) => {
+  await runCheckExports(options);
+});
+program.command("check-clean-tree").description("Assert working tree is clean (no modified or untracked files)").option("--paths <paths...>", "Limit check to specific paths").action(async (options) => {
+  await runCheckCleanTree(options);
+});
+program.command("check-readme-imports").description("Validate README import examples match package exports").option("--json", "Output results as JSON").action(async (options) => {
+  const { runCheckReadmeImports } = await import("../shared/chunk-6a7tjcgm.js");
+  await runCheckReadmeImports(options);
+});
+program.command("check-boundary-invocations").description("Validate root/app scripts do not execute packages/*/src entrypoints directly").action(async () => {
+  await runCheckBoundaryInvocations();
+});
 program.parse();