etymd 0.2.1 → 0.3.0

package/dist/{chunk-4UZBCCFJ.js → chunk-3NYDVB4Z.js}

@@ -1,26 +1,8 @@
 #!/usr/bin/env node
-import { PACK_VERSION } from './chunk-E2Q7WFPN.js';
-import { pathExists, readText } from './chunk-LBRNZZZF.js';
-import { promises } from 'node:fs';
+import { PACK_VERSION } from './chunk-CRJHIXJH.js';
+import { pathExists, readText } from './chunk-YLNQQZ5F.js';
 import path from 'node:path';
 
-async function applyFiles(root, files, overwrite = /* @__PURE__ */ new Set()) {
-  const written = [];
-  const skipped = [];
-  for (const file of files) {
-    if (file.exists && !overwrite.has(file.path)) {
-      skipped.push(file.path);
-      continue;
-    }
-    const abs = path.join(root, file.path);
-    await promises.mkdir(path.dirname(abs), { recursive: true });
-    await promises.writeFile(abs, file.contents, "utf8");
-    if (file.executable) await promises.chmod(abs, 493);
-    written.push(file.path);
-  }
-  return { written, skipped };
-}
-
 // src/pack/templates.ts
 function runPrefix(pm) {
   switch (pm) {
@@ -128,22 +110,119 @@ ${[
 <!-- etymd pack v${PACK_VERSION} -->
 `;
 }
+var CONTENT_GATE_RESOLUTION = `GATE="\${CONTENT_GATE:-$(command -v etymd || true)}"`;
+function localHookCall(hook) {
+  return `# Repo-owned checks. This file is generated and will be overwritten; \`.githooks/${hook}.local\`
+# is yours \u2014 etymd never reads, writes, or regenerates it. Put project-specific guards there.
+LOCAL="$(dirname "$0")/${hook}.local"
+if [ -x "$LOCAL" ]; then
+  "$LOCAL" "$@" || exit 1
+fi`;
+}
 function generatePreCommitHook() {
   return `#!/usr/bin/env sh
 # etymd: process gate. Cheap, locally-knowable checks belong here (fast, blocks the commit).
+
+${localHookCall("pre-commit")}
+
+# Content screen \u2014 staged file bytes. Refuses to commit environment, employer or identity
+# detail into a repo whose history is (or could become) public. The checker and its patterns
+# are machine-local by design, so this is a NO-OP wherever no checker is installed: safe to
+# commit anywhere, active only where you opted in.
+#
+# Bypass, with a reason: git commit --no-verify
+${CONTENT_GATE_RESOLUTION}
+if [ -x "$GATE" ]; then
+  "$GATE" screen --staged || exit 1
+fi
+
+exit 0
+`;
+}
+function generateCommitMsgHook() {
+  return `#!/usr/bin/env sh
+# etymd: content screen \u2014 the commit message itself.
+#
+# The staged-content gate reads file bytes and never sees the message, yet a message is as
+# permanently published as any file. No-op where no checker is installed.
+#
+# Bypass, with a reason: git commit --no-verify
+GATE="\${COMMIT_MSG_GATE:-$(command -v etymd || true)}"
+if [ -x "$GATE" ]; then
+  "$GATE" screen --message "$1" || exit 1
+fi
+
+${localHookCall("commit-msg")}
+
 exit 0
 `;
 }
-function generatePrePushHook(facts) {
+function generatePrePushHook(facts, gates) {
   const run = runPrefix(facts.packageManager);
   const c = facts.commands;
-  const candidates = [c.formatCheck, c.typecheck, c.lint];
-  const steps = candidates.filter((key) => Boolean(key) && isSafeGateCommand(c.raw[key])).map((key) => `${run} ${key}`);
+  const candidates = gates?.commands.length ? gates.commands : [c.formatCheck, c.typecheck, c.lint];
+  const allowed = new Set(gates?.allowWriting ?? []);
+  const steps = candidates.filter(
+    (key) => Boolean(key) && (allowed.has(key) || isSafeGateCommand(c.raw[key]))
+  ).map((key) => `${run} ${key}`);
   const body = steps.length ? steps.map((s) => `echo "\u203A ${s}"
 ${s} || exit 1`).join("\n") : 'echo "etymd: no correctness commands detected \u2014 add format:check / typecheck / lint"';
+  const failOn = gates?.failOn ?? "risk";
+  const auditStep = `
+if command -v etymd >/dev/null 2>&1; then
+  echo "\u203A etymd audit --fail-on ${failOn}"
+  etymd audit --no-ledger --fail-on ${failOn} || exit 1
+else
+  echo "\u203A etymd audit skipped (not on PATH)"
+fi`;
   return `#!/usr/bin/env sh
 # etymd: correctness gate. Mirrors CI cheapest-first; blocks the push on any failure.
+
+${localHookCall("pre-push")}
 ${body}
+${auditStep}
+
+# Content screen, second pass \u2014 the WHOLE TREE rather than one diff. Catches anything committed
+# with --no-verify and anything a rebase or merge brought in from elsewhere. Advisory here (it
+# never blocks the push): the blocking decision belongs at commit time, where the fix is cheap.
+${CONTENT_GATE_RESOLUTION}
+if [ -x "$GATE" ] && [ "\${CONTENT_GATE_PREPUSH:-1}" = "1" ]; then
+  "$GATE" screen --tree --advisory || true
+fi
+
+exit 0
+`;
+}
+function generateArtifactCheckScript() {
+  return `#!/usr/bin/env sh
+# etymd: content screen \u2014 the published ARTIFACT, not the repository.
+#
+# Wire it into the irreversible moment:
+#   package.json \u2192 "prepublishOnly": "./scripts/artifact-check.sh"
+#
+# No-op where no checker is installed. Bypass is deliberate and loud: ARTIFACT_CHECK_SKIP=1.
+set -eu
+
+if [ "\${ARTIFACT_CHECK_SKIP:-0}" = "1" ]; then
+  echo "\u203A artifact-check: SKIPPED by ARTIFACT_CHECK_SKIP=1"
+  exit 0
+fi
+
+${CONTENT_GATE_RESOLUTION}
+[ -x "$GATE" ] || { echo "\u203A artifact-check: no checker installed \u2014 skipping."; exit 0; }
+
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT INT TERM
+
+# Pack exactly what would ship, then screen the unpacked bytes.
+if [ -f package.json ]; then
+  npm pack --pack-destination "$WORK" >/dev/null 2>&1 || {
+    echo "\u203A artifact-check: npm pack failed \u2014 cannot verify what would ship" >&2; exit 1; }
+  tar -xzf "$WORK"/*.tgz -C "$WORK" 2>/dev/null || true
+fi
+
+"$GATE" screen --dir "$WORK" || exit 1
+exit 0
 `;
 }
 
@@ -168,9 +247,28 @@ async function planWorkflow(root, facts, opts) {
   }
   if (opts.gates) {
     await add(".githooks/pre-commit", generatePreCommitHook(), "Process gate (pre-commit)", true);
-    await add(".githooks/pre-push", generatePrePushHook(facts), "Correctness gate (pre-push)", true);
+    await add(
+      ".githooks/commit-msg",
+      generateCommitMsgHook(),
+      "Content screen (commit message)",
+      true
+    );
+    await add(
+      ".githooks/pre-push",
+      generatePrePushHook(facts, opts.gateConfig),
+      "Correctness gate (pre-push)",
+      true
+    );
+    if (opts.gateConfig?.publishGate ?? opts.publishGate ?? facts.publishable) {
+      await add(
+        "scripts/artifact-check.sh",
+        generateArtifactCheckScript(),
+        "Content screen (published artifact)",
+        true
+      );
+    }
   }
   return out;
 }
 
-export { applyFiles, planWorkflow };
+export { isSafeGateCommand, planWorkflow, runPrefix };

package/dist/chunk-CRJHIXJH.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+// src/pack/version.ts
+var PACK_VERSION = "3";
+
+export { PACK_VERSION };

package/dist/chunk-EF6BPBG6.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+import { promises } from 'node:fs';
+import path from 'node:path';
+
+async function applyFiles(root, files, overwrite = /* @__PURE__ */ new Set()) {
+  const written = [];
+  const skipped = [];
+  for (const file of files) {
+    if (file.exists && !overwrite.has(file.path)) {
+      skipped.push(file.path);
+      continue;
+    }
+    const abs = path.join(root, file.path);
+    await promises.mkdir(path.dirname(abs), { recursive: true });
+    await promises.writeFile(abs, file.contents, "utf8");
+    if (file.executable) await promises.chmod(abs, 493);
+    written.push(file.path);
+  }
+  return { written, skipped };
+}
+
+export { applyFiles };

package/dist/chunk-LT67FU2Y.js

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+import { DEFAULT_CONFIG } from './chunk-NMZ3RHWW.js';
+import { readText, wordCount, approxTokens, pathExists } from './chunk-YLNQQZ5F.js';
+import { promises } from 'node:fs';
+import path from 'node:path';
+
+var ALWAYS_LOADED = [
+  { path: "AGENTS.md", role: "operating contract" },
+  { path: "PROJECT_CONTEXT.md", role: "ground-truth state" },
+  { path: "CLAUDE.md", role: "Claude Code pointer" },
+  { path: "GEMINI.md", role: "Gemini pointer" },
+  { path: ".github/copilot-instructions.md", role: "Copilot instructions" },
+  { path: ".cursorrules", role: "Cursor rules (legacy)" }
+];
+var EXTRACTION_THRESHOLD = DEFAULT_CONFIG.context.perFileWords;
+function isAlwaysAppliedCursorRule(text) {
+  const fm = text.match(/^---\n([\s\S]*?)\n---/);
+  if (!fm) return true;
+  const frontmatter = fm[1] ?? "";
+  return /^\s*alwaysApply\s*:\s*true\s*$/m.test(frontmatter);
+}
+async function measureContext(root, perFileWords = EXTRACTION_THRESHOLD) {
+  const files = [];
+  for (const spec of ALWAYS_LOADED) {
+    const abs = path.join(root, spec.path);
+    const text = await readText(abs);
+    if (text === null) continue;
+    const words = wordCount(text);
+    files.push({ path: spec.path, role: spec.role, words, approxTokens: approxTokens(words) });
+  }
+  const rulesDir = path.join(root, ".cursor", "rules");
+  if (await pathExists(rulesDir)) {
+    try {
+      for (const entry of await promises.readdir(rulesDir)) {
+        if (!entry.endsWith(".mdc") && !entry.endsWith(".md")) continue;
+        const text = await readText(path.join(rulesDir, entry));
+        if (text === null || !isAlwaysAppliedCursorRule(text)) continue;
+        const words = wordCount(text);
+        files.push({
+          path: `.cursor/rules/${entry}`,
+          role: "Cursor rule (always applied)",
+          words,
+          approxTokens: approxTokens(words)
+        });
+      }
+    } catch {
+    }
+  }
+  const totalWords = files.reduce((s, f) => s + f.words, 0);
+  return {
+    files: files.sort((a, b) => b.words - a.words),
+    totalWords,
+    totalApproxTokens: approxTokens(totalWords),
+    perFileWords,
+    extractionCandidates: files.filter((f) => f.words >= perFileWords)
+  };
+}
+
+export { measureContext };

package/dist/{chunk-E2Q7WFPN.js → chunk-MKYPLNLH.js}

@@ -1,11 +1,10 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-C4Z6NXDO.js';
-import { normalizeRelPath, isDirectory, readJson, git, matchesAnyGlob, pathExists, readText } from './chunk-LBRNZZZF.js';
+import { VERSION } from './chunk-NFENQ3IK.js';
+import { PACK_VERSION } from './chunk-CRJHIXJH.js';
+import { normalizeRelPath, isDirectory, readJson, git, matchesAnyGlob, pathExists, readText } from './chunk-YLNQQZ5F.js';
 import path from 'node:path';
 import { promises } from 'node:fs';
 
-// src/pack/version.ts
-var PACK_VERSION = "2";
 var IGNORED_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -564,10 +563,14 @@ async function scanProject(root, opts = {}) {
     commands: classifyCommands(rootPkg?.scripts),
     ci,
     hooks,
+    publishable: Boolean(rootPkg) && rootPkg?.private !== true,
+    // `engines.vscode` is what makes a package an extension, and extensions publish through
+    // vsce — which never runs prepublishOnly.
+    publishRoute: !rootPkg ? "none" : rootPkg.engines?.vscode ? "vscode" : "npm",
     artifacts,
     freshness,
     tree
   };
 }
 
-export { PACK_VERSION, expandFileGlobs, scanProject };
+export { expandFileGlobs, scanProject };

package/dist/{chunk-EUIHYD6F.js → chunk-MMPV67FW.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { readLedger, resolveEntry, writeLedger } from './chunk-KBF3SW3N.js';
-import { print, renderLedger, glyph, theme } from './chunk-LBRNZZZF.js';
+import { readLedger, resolveEntry, writeLedger } from './chunk-WWBF4Y7K.js';
+import { print, renderLedger, glyph, theme } from './chunk-TADKOW6P.js';
 
 // src/commands/ledger.ts
 async function list(opts) {

package/dist/{chunk-C4Z6NXDO.js → chunk-NFENQ3IK.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // package.json
 var package_default = {
-  version: "0.2.1"};
+  version: "0.3.0"};
 
 // src/version.ts
 var VERSION = package_default.version;

package/dist/{chunk-ANCCGYSH.js → chunk-NMZ3RHWW.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
-import { ETYMD_DIR } from './chunk-FZSIOCOZ.js';
-import { pathExists, readText, wordCount, approxTokens } from './chunk-LBRNZZZF.js';
-import path2 from 'node:path';
-import { promises } from 'node:fs';
+import { ETYMD_DIR } from './chunk-R74SJ7HS.js';
+import { pathExists, readText } from './chunk-YLNQQZ5F.js';
+import path from 'node:path';
 
-var CONFIG_FILE = path2.join(ETYMD_DIR, "config.json");
+var CONFIG_FILE = path.join(ETYMD_DIR, "config.json");
 var DEFAULT_CONFIG = {
   instructions: { include: [], exclude: [] },
   context: { perFileWords: 4e3, totalWords: 8e3 },
-  state: { staleAfterDays: 30, maxChars: 9500 }
+  state: { staleAfterDays: 30, maxChars: 9500 },
+  gates: { commands: [], failOn: "risk", allowWriting: [] }
 };
 function configPath(root) {
-  return path2.join(root, CONFIG_FILE);
+  return path.join(root, CONFIG_FILE);
 }
 function readGlobList(value, key, problems) {
   if (value === void 0) return void 0;
@@ -53,6 +53,23 @@ async function readConfig(root) {
   const instructions = obj.instructions ?? {};
   const context = obj.context ?? {};
   const state = obj.state ?? {};
+  const gates = obj.gates ?? {};
+  const failOn = (() => {
+    if (gates.failOn === void 0) return void 0;
+    if (typeof gates.failOn !== "string" || !["risk", "gap", "polish"].includes(gates.failOn.toLowerCase())) {
+      problems.push(`${CONFIG_FILE}: \`gates.failOn\` must be risk | gap | polish \u2014 ignored.`);
+      return void 0;
+    }
+    return gates.failOn.toLowerCase();
+  })();
+  const publishGate = (() => {
+    if (gates.publishGate === void 0) return void 0;
+    if (typeof gates.publishGate !== "boolean") {
+      problems.push(`${CONFIG_FILE}: \`gates.publishGate\` must be true or false \u2014 ignored.`);
+      return void 0;
+    }
+    return gates.publishGate;
+  })();
   return {
     present: true,
     problems,
@@ -68,60 +85,15 @@ async function readConfig(root) {
       state: {
         staleAfterDays: readBudget(state.staleAfterDays, "state.staleAfterDays", problems) ?? DEFAULT_CONFIG.state.staleAfterDays,
         maxChars: readBudget(state.maxChars, "state.maxChars", problems) ?? DEFAULT_CONFIG.state.maxChars
+      },
+      gates: {
+        commands: readGlobList(gates.commands, "gates.commands", problems) ?? DEFAULT_CONFIG.gates.commands,
+        failOn: failOn ?? DEFAULT_CONFIG.gates.failOn,
+        publishGate,
+        allowWriting: readGlobList(gates.allowWriting, "gates.allowWriting", problems) ?? DEFAULT_CONFIG.gates.allowWriting
       }
     }
   };
 }
-var ALWAYS_LOADED = [
-  { path: "AGENTS.md", role: "operating contract" },
-  { path: "PROJECT_CONTEXT.md", role: "ground-truth state" },
-  { path: "CLAUDE.md", role: "Claude Code pointer" },
-  { path: "GEMINI.md", role: "Gemini pointer" },
-  { path: ".github/copilot-instructions.md", role: "Copilot instructions" },
-  { path: ".cursorrules", role: "Cursor rules (legacy)" }
-];
-var EXTRACTION_THRESHOLD = DEFAULT_CONFIG.context.perFileWords;
-function isAlwaysAppliedCursorRule(text) {
-  const fm = text.match(/^---\n([\s\S]*?)\n---/);
-  if (!fm) return true;
-  const frontmatter = fm[1] ?? "";
-  return /^\s*alwaysApply\s*:\s*true\s*$/m.test(frontmatter);
-}
-async function measureContext(root, perFileWords = EXTRACTION_THRESHOLD) {
-  const files = [];
-  for (const spec of ALWAYS_LOADED) {
-    const abs = path2.join(root, spec.path);
-    const text = await readText(abs);
-    if (text === null) continue;
-    const words = wordCount(text);
-    files.push({ path: spec.path, role: spec.role, words, approxTokens: approxTokens(words) });
-  }
-  const rulesDir = path2.join(root, ".cursor", "rules");
-  if (await pathExists(rulesDir)) {
-    try {
-      for (const entry of await promises.readdir(rulesDir)) {
-        if (!entry.endsWith(".mdc") && !entry.endsWith(".md")) continue;
-        const text = await readText(path2.join(rulesDir, entry));
-        if (text === null || !isAlwaysAppliedCursorRule(text)) continue;
-        const words = wordCount(text);
-        files.push({
-          path: `.cursor/rules/${entry}`,
-          role: "Cursor rule (always applied)",
-          words,
-          approxTokens: approxTokens(words)
-        });
-      }
-    } catch {
-    }
-  }
-  const totalWords = files.reduce((s, f) => s + f.words, 0);
-  return {
-    files: files.sort((a, b) => b.words - a.words),
-    totalWords,
-    totalApproxTokens: approxTokens(totalWords),
-    perFileWords,
-    extractionCandidates: files.filter((f) => f.words >= perFileWords)
-  };
-}
 
-export { CONFIG_FILE, DEFAULT_CONFIG, measureContext, readConfig };
+export { CONFIG_FILE, DEFAULT_CONFIG, configPath, readConfig };

package/dist/{chunk-FZSIOCOZ.js → chunk-R74SJ7HS.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { readJson } from './chunk-LBRNZZZF.js';
+import { readJson } from './chunk-YLNQQZ5F.js';
 import { promises } from 'node:fs';
 import path from 'node:path';
 

package/dist/{chunk-LBRNZZZF.js → chunk-TADKOW6P.js}

@@ -1,104 +1,6 @@
 #!/usr/bin/env node
-import { execFile } from 'node:child_process';
-import { promises } from 'node:fs';
-import { promisify } from 'node:util';
 import pc from 'picocolors';
 
-var pExecFile = promisify(execFile);
-async function pathExists(p) {
-  try {
-    await promises.access(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function readJson(p) {
-  try {
-    const raw = await promises.readFile(p, "utf8");
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-async function readText(p) {
-  try {
-    return await promises.readFile(p, "utf8");
-  } catch {
-    return null;
-  }
-}
-async function isDirectory(p) {
-  try {
-    return (await promises.stat(p)).isDirectory();
-  } catch {
-    return false;
-  }
-}
-async function git(root, args) {
-  try {
-    const { stdout } = await pExecFile("git", args, { cwd: root, timeout: 4e3 });
-    return stdout.trim();
-  } catch {
-    return null;
-  }
-}
-function wordCount(text) {
-  const m = text.trim().match(/\S+/g);
-  return m ? m.length : 0;
-}
-function approxTokens(words) {
-  return Math.round(words / 0.75);
-}
-var CI_ENV_VARS = [
-  "CI",
-  "GITHUB_ACTIONS",
-  "GITLAB_CI",
-  "BUILDKITE",
-  "CIRCLECI",
-  "JENKINS_URL",
-  "TF_BUILD"
-];
-function isCiEnvironment() {
-  return CI_ENV_VARS.some((v) => Boolean(process.env[v]));
-}
-function normalizeRelPath(p) {
-  return p.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
-}
-function globToRegExp(glob) {
-  let re = "";
-  for (let i = 0; i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "*") {
-      if (glob[i + 1] === "*") {
-        i += 1;
-        if (glob[i + 1] === "/") {
-          i += 1;
-          re += "(?:.*/)?";
-        } else {
-          re += ".*";
-        }
-      } else {
-        re += "[^/]*";
-      }
-    } else if (c === "?") {
-      re += "[^/]";
-    } else {
-      re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
-    }
-  }
-  return new RegExp(`^${re}$`);
-}
-function matchesGlob(p, glob) {
-  const target = normalizeRelPath(p);
-  const pattern = normalizeRelPath(glob);
-  if (!pattern) return false;
-  if (!/[*?]/.test(pattern)) return target === pattern || target.startsWith(pattern + "/");
-  return globToRegExp(pattern).test(target);
-}
-function matchesAnyGlob(p, globs) {
-  return globs.some((g) => matchesGlob(p, g));
-}
 var theme = {
   brand: (s) => pc.magenta(pc.bold(s)),
   heading: (s) => pc.bold(s),
@@ -356,4 +258,4 @@ function renderLedger(ledger) {
   }
 }
 
-export { TIER_BADGE, approxTokens, git, glyph, isCiEnvironment, isDirectory, matchesAnyGlob, normalizeRelPath, pathExists, print, readJson, readText, renderBaselineDrift, renderContext, renderFacts, renderFindings, renderFleetNotes, renderFleetRows, renderLedger, renderLedgerDiff, renderLensCoverage, renderPlan, section, theme, wordCount };
+export { TIER_BADGE, glyph, print, renderBaselineDrift, renderContext, renderFacts, renderFindings, renderFleetNotes, renderFleetRows, renderLedger, renderLedgerDiff, renderLensCoverage, renderPlan, section, theme };

package/dist/{chunk-SS7VGLJ5.js → chunk-V3DPLOOM.js}

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
-import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-KBF3SW3N.js';
-import { DEFAULT_CONFIG, readConfig, CONFIG_FILE, measureContext } from './chunk-ANCCGYSH.js';
-import { scanProject, PACK_VERSION, expandFileGlobs } from './chunk-E2Q7WFPN.js';
-import { ETYMD_DIR, writeCachedFacts, readBaseline, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE } from './chunk-FZSIOCOZ.js';
-import { pathExists, readJson, git, readText, isDirectory, matchesAnyGlob, isCiEnvironment, normalizeRelPath } from './chunk-LBRNZZZF.js';
+import { measureContext } from './chunk-LT67FU2Y.js';
+import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-WWBF4Y7K.js';
+import { DEFAULT_CONFIG, readConfig, CONFIG_FILE } from './chunk-NMZ3RHWW.js';
+import { ETYMD_DIR, writeCachedFacts, readBaseline, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE } from './chunk-R74SJ7HS.js';
+import { scanProject, expandFileGlobs } from './chunk-MKYPLNLH.js';
+import { PACK_VERSION } from './chunk-CRJHIXJH.js';
+import { pathExists, readJson, git, readText, isDirectory, matchesAnyGlob, isCiEnvironment, normalizeRelPath } from './chunk-YLNQQZ5F.js';
 import path from 'node:path';
 import YAML from 'yaml';
 import { promises } from 'node:fs';
@@ -91,24 +93,78 @@ var TOOL_MATCHERS = [
   ["lint", /\beslint\b/],
   ["test", /\bjest\b|\bvitest\b|react-scripts test|\bnx\b[^&|;]*\btest\b/]
 ];
+var PM_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "run",
+  "run-script",
+  "install",
+  "i",
+  "ci",
+  "add",
+  "remove",
+  "rm",
+  "uninstall",
+  "un",
+  "update",
+  "up",
+  "upgrade",
+  "create",
+  "init",
+  "audit",
+  "publish",
+  "pack",
+  "link",
+  "unlink",
+  "why",
+  "list",
+  "ls",
+  "outdated",
+  "prune",
+  "dedupe",
+  "import",
+  "rebuild",
+  "root",
+  "config",
+  "cache",
+  "login",
+  "logout",
+  "whoami",
+  "version",
+  "workspace",
+  "workspaces",
+  "store",
+  "fund",
+  "deprecate",
+  "access",
+  "bin",
+  "env",
+  "help"
+]);
+var PM_BINARY_RUNNERS = /* @__PURE__ */ new Set(["exec", "dlx", "x"]);
+var NPX_SCRIPT_RUNNERS = /* @__PURE__ */ new Set(["run-s", "run-p", "npm-run-all"]);
 function expandScriptRefs(command, scripts, depth = 2) {
   if (depth <= 0) return command;
   let expanded = command;
-  for (const m of command.matchAll(
-    /(?:yarn|pnpm|npm run|bun run|npx run-s|npx run-p)\s+([A-Za-z0-9:._-]+)/g
-  )) {
-    const name = m[1];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (name) => {
+    if (seen.has(name)) return;
+    seen.add(name);
     const body = scripts[name];
     if (body) expanded += `
 ${expandScriptRefs(body, scripts, depth - 1)}`;
+  };
+  for (const m of command.matchAll(/\b(yarn|pnpm|npm|bun|npx)\b([^&|;]*)/g)) {
+    const manager = m[1];
+    const tokens = (m[2] ?? "").split(/\s+/).map((t) => t.replace(/["']/g, "")).filter(Boolean);
+    if (manager === "npx" && !(tokens[0] && NPX_SCRIPT_RUNNERS.has(tokens[0]))) continue;
+    for (const token of tokens) {
+      if (token.startsWith("-")) continue;
+      if (PM_BINARY_RUNNERS.has(token)) break;
+      if (PM_SUBCOMMANDS.has(token) || NPX_SCRIPT_RUNNERS.has(token)) continue;
+      add(token);
+    }
   }
   if (/npm-run-all|run-s|run-p/.test(command)) {
-    for (const token of command.split(/\s+/)) {
-      const clean = token.replace(/["']/g, "");
-      const body = scripts[clean];
-      if (body) expanded += `
-${expandScriptRefs(body, scripts, depth - 1)}`;
-    }
+    for (const token of command.split(/\s+/)) add(token.replace(/["']/g, ""));
   }
   return expanded;
 }

package/dist/{chunk-KBF3SW3N.js → chunk-WWBF4Y7K.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { readJson } from './chunk-LBRNZZZF.js';
+import { readJson } from './chunk-YLNQQZ5F.js';
 import { promises } from 'node:fs';
 import path from 'node:path';
 

package/dist/{chunk-6W3J4PJ6.js → chunk-XTAX4YNT.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { parseFailOnTier, runAudit, meetsFailOn } from './chunk-SS7VGLJ5.js';
-import { print, section, theme, renderLensCoverage, renderFindings, renderLedgerDiff } from './chunk-LBRNZZZF.js';
+import { parseFailOnTier, runAudit, meetsFailOn } from './chunk-V3DPLOOM.js';
+import { print, section, theme, renderLensCoverage, renderFindings, renderLedgerDiff } from './chunk-TADKOW6P.js';
 
 // src/commands/audit.ts
 async function run(opts) {