onsystem 0.0.1 → 0.4.0

package/dist/cli.js

@@ -0,0 +1,1129 @@
+#!/usr/bin/env node
+import { A as CONFIG_FILES, G as unique, I as LEGACY_CONFIG_FILES, J as toPosix, K as matchesGlob, L as RULE_IDS, M as DEFAULT_DOCS, N as DEFAULT_SEVERITY, U as detectProject, V as rulesFor, W as plural, b as uncheckedNotice, c as componentFiles, d as tokenFiles, f as NAME, h as stderrLogger, j as ConfigError, m as silentLogger, n as loadTarget, p as VERSION, q as relativePath, t as serveStdio, u as loadDesignSystem, x as formatDiagnostics } from "./stdio-BcJth14k.js";
+import fs from "node:fs";
+import path from "node:path";
+import { escapePath, glob } from "tinyglobby";
+import fs$1 from "node:fs/promises";
+import { spawnSync } from "node:child_process";
+import readline from "node:readline/promises";
+import { parseArgs } from "node:util";
+//#region src/baseline.ts
+const BASELINE_FILE = "onsystem.baseline.json";
+/** The baseline's name from before the rename to onsystem: still read when the new one is absent. */
+const LEGACY_BASELINE_FILE = "design-system-mcp.baseline.json";
+/**
+* A finding's identity within its file and rule: the offending text with
+* whitespace collapsed, and without the quotes of a string literal, so a
+* formatter switching quote style does not make every finding look new.
+*/
+function key(diagnostic) {
+	const text = diagnostic.source.replace(/\s+/g, " ").trim();
+	return (/^(['"`])(.*)\1$/.exec(text)?.[2] ?? text).slice(0, 200);
+}
+/** The baseline's entries, or undefined when the file does not exist. */
+function readBaseline(file) {
+	let text;
+	try {
+		text = fs.readFileSync(file, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return void 0;
+		throw new ConfigError(`Could not read baseline ${file}: ${error.message}`);
+	}
+	const invalid = (why) => new ConfigError(`${file} is not a valid onsystem baseline (${why}). Fix it, or delete it and run check --update-baseline.`);
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch (error) {
+		throw invalid(error.message);
+	}
+	if (!isObject(parsed) || parsed.version !== 1) throw invalid("expected \"version\": 1");
+	if (!isObject(parsed.files)) throw invalid("\"files\" must be an object");
+	const entries = /* @__PURE__ */ new Map();
+	for (const [name, rules] of Object.entries(parsed.files)) {
+		if (!isObject(rules)) throw invalid(`"${name}" must map rules to findings`);
+		const byRule = /* @__PURE__ */ new Map();
+		for (const [rule, sources] of Object.entries(rules)) {
+			if (!isObject(sources)) throw invalid(`"${name}" › "${rule}" must map findings to counts`);
+			const counts = /* @__PURE__ */ new Map();
+			for (const [source, count] of Object.entries(sources)) {
+				if (!Number.isInteger(count) || count < 1) throw invalid(`"${name}" › "${rule}" › "${source}" must be a positive whole number`);
+				counts.set(source, count);
+			}
+			byRule.set(rule, counts);
+		}
+		entries.set(name, byRule);
+	}
+	return entries;
+}
+/**
+* Removes the findings the baseline accepts for `file`. Within a file and
+* rule, each entry accepts that many findings with the same source text, in
+* order; any beyond the count are new. Entries of `disabled` rules are not
+* counted as fixed: the rule is off, not satisfied.
+*/
+function applyBaseline(baseline, file, result, disabled = /* @__PURE__ */ new Set()) {
+	const remaining = /* @__PURE__ */ new Map();
+	for (const [rule, sources] of baseline.get(file) ?? []) {
+		if (disabled.has(rule)) continue;
+		for (const [source, count] of sources) remaining.set(`${rule}\0${source}`, count);
+	}
+	const diagnostics = [];
+	let baselined = 0;
+	for (const diagnostic of result.diagnostics) {
+		const id = `${diagnostic.ruleId}\0${key(diagnostic)}`;
+		const left = remaining.get(id) ?? 0;
+		if (left > 0) {
+			remaining.set(id, left - 1);
+			baselined++;
+		} else diagnostics.push(diagnostic);
+	}
+	let fixed = 0;
+	for (const count of remaining.values()) fixed += count;
+	return {
+		result: {
+			...result,
+			diagnostics,
+			errorCount: diagnostics.filter((d) => d.severity === "error").length,
+			warningCount: diagnostics.filter((d) => d.severity === "warning").length
+		},
+		baselined,
+		fixed
+	};
+}
+/**
+* The baseline after a run over `checked` (file → its findings): those files
+* get exactly their current findings, plus their previous entries for
+* `disabled` rules; other files keep their entries while they still exist
+* under `root`.
+*/
+function updateBaseline(previous, checked, root, disabled = /* @__PURE__ */ new Set()) {
+	const disabledIn = typeof disabled === "function" ? disabled : () => disabled;
+	const next = /* @__PURE__ */ new Map();
+	for (const [file, rules] of previous ?? []) if (!checked.has(file) && fs.existsSync(path.resolve(root, file))) next.set(file, rules);
+	for (const [file, diagnostics] of checked) {
+		const rules = /* @__PURE__ */ new Map();
+		const off = disabledIn(file);
+		for (const [rule, sources] of previous?.get(file) ?? []) if (off.has(rule)) rules.set(rule, sources);
+		for (const diagnostic of diagnostics) {
+			let sources = rules.get(diagnostic.ruleId);
+			if (!sources) rules.set(diagnostic.ruleId, sources = /* @__PURE__ */ new Map());
+			const id = key(diagnostic);
+			sources.set(id, (sources.get(id) ?? 0) + 1);
+		}
+		if (rules.size) next.set(file, rules);
+	}
+	return next;
+}
+function countBaseline(entries) {
+	let findings = 0;
+	for (const rules of entries.values()) for (const sources of rules.values()) for (const count of sources.values()) findings += count;
+	return {
+		findings,
+		files: entries.size
+	};
+}
+/** Writes the baseline sorted at every level, so it diffs cleanly in review. */
+function writeBaseline(file, entries) {
+	const sorted = (map) => [...map].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	const files = {};
+	for (const [name, rules] of sorted(entries)) {
+		const byRule = {};
+		for (const [rule, sources] of sorted(rules)) byRule[rule] = Object.fromEntries(sorted(sources));
+		Object.defineProperty(files, name, {
+			value: byRule,
+			enumerable: true,
+			writable: true
+		});
+	}
+	const baseline = {
+		version: 1,
+		files
+	};
+	try {
+		fs.writeFileSync(file, `${JSON.stringify(baseline, null, 2)}\n`);
+	} catch (error) {
+		throw new ConfigError(`Could not write baseline ${file}: ${error.message}`);
+	}
+}
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/explain.ts
+/**
+* What `inspect --explain` says about one project: every candidate zero config looked
+* at and why each was taken or not, the config it resolved to, tokens whose value did
+* not resolve, and components without props, with the likely reason.
+*/
+function explainProject(ds, cwd, indent = "") {
+	const { config, model } = ds;
+	const lines = [];
+	const out = (line = "") => lines.push(line ? `${indent}${line}` : "");
+	out("How the design system was found");
+	if (config.configured) out(`  components come from ${config.configFile ? display(cwd, config.configFile) : "--components"}, so zero config did not look`);
+	else {
+		const steps = [];
+		detectProject(config.root, config.tsconfig, steps);
+		for (const step of steps) out(`  ${(step.accepted ? "found" : "no").padEnd(6)} ${step.candidate}: ${step.reason}`);
+		if (!config.detected) out(`  So the defaults apply: ${config.components.join(", ")}${model.stats.files.components ? "" : ", which match nothing"}.`);
+	}
+	out();
+	out("Resolved config");
+	const field = (name, value) => out(`  ${name.padEnd(12)} ${value}`);
+	field("root", config.root);
+	field("config", config.configFile ? display(cwd, config.configFile) : "(none)");
+	field("components", listOf$1(config.components) || "(none)");
+	field("exclude", listOf$1(config.exclude));
+	field("tokens", listOf$1(config.tokens.map((t) => `${t.path}${t.prefix ? ` (prefix ${t.prefix})` : ""}`)));
+	field("docs", listOf$1(config.docs));
+	field("tsconfig", config.tsconfig ?? (fs.existsSync(path.join(config.root, "tsconfig.json")) ? "tsconfig.json" : "(none)"));
+	field("importPath", importPaths(ds));
+	if (config.tailwindConfig) field("tailwind", display(config.root, config.tailwindConfig));
+	if (config.designSystems) field("primary", config.designSystems.map((d, i) => `${i ? "then " : ""}${d.source} (${d.imports} imports)`).join("; "));
+	const changed = RULE_IDS.filter((id) => config.rules[id].severity !== DEFAULT_SEVERITY[id]);
+	field("rules", `${RULE_IDS.map((id) => `${id} ${config.rules[id].severity}`).join(", ")}${changed.length ? ` (changed: ${changed.join(", ")})` : ""}`);
+	if (config.overrides?.length) for (const override of config.overrides) field("override", `${override.files.join(", ")}: ${Object.entries(override.rules).map(([id, rule]) => `${id} ${rule.severity}`).join(", ")}`);
+	if (config.base) field("relative to", `${config.base} (a config at the workspace root)`);
+	out();
+	out("Tokens");
+	const found = ds.tokens;
+	const files = model.stats.files.tokens;
+	out(`  ${found.length} tokens from ${files} ${files === 1 ? "file" : "files"}${files ? "" : `: no file matches ${config.tokens.map((t) => t.path).join(", ")}`}`);
+	const defined = new Set(found.map((t) => t.cssVar).filter((v) => Boolean(v)));
+	const missing = (value) => [...value.matchAll(/var\(\s*(--[\w-]+)/g)].map((m) => m[1] ?? "").filter((v) => !defined.has(v));
+	const unresolved = found.filter((t) => missing(t.value).length);
+	if (unresolved.length) out(`  ${unresolved.length} unresolved, reading a custom property no token file defines: ${unresolved.slice(0, 8).map((t) => `${t.cssVar ?? t.name}: ${t.value}`).join(", ")}${unresolved.length > 8 ? `, and ${unresolved.length - 8} more` : ""}`);
+	else if (found.length) out("  every value resolves");
+	for (const warning of model.warnings.filter((w) => /alias|token/i.test(w))) out(`  ${warning}`);
+	out();
+	out("Props");
+	const empty = ds.roots().filter((c) => c.openProps && !c.props.length && !c.inherits.length);
+	const open = ds.components.filter((c) => c.openProps);
+	if (!open.length) out(`  every component's props resolved (${ds.components.length} components)`);
+	else {
+		const installed = nodeModulesFor(config.root);
+		const names = (list) => `${list.slice(0, 6).map((c) => c.name).join(", ")}${list.length > 6 ? ` and ${list.length - 6} more` : ""}`;
+		if (empty.length) out(`  ${empty.length} ${empty.length === 1 ? "component has" : "components have"} 0 props: ${names(empty)}.`);
+		out(`  ${open.length} ${open.length === 1 ? "component has" : "components have"} props that did not fully resolve${empty.length === open.length ? "" : `: ${names(open)}`}, so no-unknown-prop skips ${open.length === 1 ? "it" : "them"}.`);
+		out(installed ? `  Dependencies are installed (${display(cwd, installed)}): a package without types, a type error, or a props type that depends on a type argument leaves them open.` : `  The dependencies are not installed: no node_modules in ${config.root} or a folder above it. Their props come from the packages they wrap (Radix, React Aria), so install them (npm install, pnpm install) and run again.`);
+	}
+	return lines;
+}
+/** The first few, then how many more: a package's exports can name hundreds of files. */
+function listOf$1(items, max = 8) {
+	const shown = items.slice(0, max).join(", ");
+	return items.length > max ? `${shown}, and ${items.length - max} more` : shown;
+}
+/** How components are suggested to be imported. */
+function importPaths(ds) {
+	if (ds.config.importPath) return `${ds.config.importPath} (from the config)`;
+	const counts = /* @__PURE__ */ new Map();
+	for (const c of ds.roots()) counts.set(c.importPath, (counts.get(c.importPath) ?? 0) + 1);
+	const top = [...counts].sort((a, b) => b[1] - a[1]).slice(0, 3);
+	const from = ds.config.imports?.length ? "package exports" : "tsconfig paths or relative paths";
+	return top.length ? `inferred from ${from}: ${top.map(([p, n]) => `${p} (${n})`).join(", ")}${counts.size > 3 ? `, and ${counts.size - 3} more` : ""}` : `inferred from ${from}`;
+}
+/** The nearest node_modules at or above `dir`, if any. */
+function nodeModulesFor(dir) {
+	for (let current = path.resolve(dir);; current = path.dirname(current)) {
+		const candidate = path.join(current, "node_modules");
+		if (fs.existsSync(candidate)) return candidate;
+		if (current === path.dirname(current)) return void 0;
+	}
+}
+function display(cwd, file) {
+	const rel = relativePath(cwd, file);
+	return rel && !rel.startsWith("..") ? rel : file;
+}
+//#endregion
+//#region src/init.ts
+const SCHEMA = "https://unpkg.com/onsystem/schema.json";
+/** More detected globs than this are files, not folders: zero config keeps them. */
+const MAX_GLOBS = 6;
+/**
+* Writes `onsystem.config.json` in the root from what zero config finds there, or from
+* the answers to up to three questions when it finds nothing, then checks the project
+* once without failing and offers to record what it found as the baseline.
+*/
+async function init(configOptions, options, io, runCheck) {
+	const { config, workspace } = await loadTarget({
+		...configOptions,
+		config: void 0
+	});
+	const root = config.root;
+	const existing = [...CONFIG_FILES, ...LEGACY_CONFIG_FILES].map((name) => path.join(root, name)).find((file) => fs.existsSync(file));
+	if (existing && !options.force) {
+		io.stderr(`init: ${relativePath(io.cwd, existing) || existing} already exists. Run \`${NAME} inspect --explain\` to see what it resolves to, or pass --force to write a new onsystem.config.json.`);
+		return 2;
+	}
+	const ask = options.yes ? void 0 : io.prompt;
+	const file = { $schema: SCHEMA };
+	const notes = [];
+	const relative = (abs) => relativePath(root, abs);
+	if (configOptions.components?.length) {
+		file.components = configOptions.components;
+		if (configOptions.tokens?.length) file.tokens = configOptions.tokens;
+		if (configOptions.docs?.length) file.docs = configOptions.docs;
+	} else if (workspace) notes.push(`This is a monorepo root: ${workspace.projects.length} of ${workspace.projects.length + workspace.others.length} workspace packages have a design system (${workspace.projects.map((p) => p.dir).join(", ") || "none"}). Each keeps zero config; rules and overrides you add here apply to every project without a config of its own.`);
+	else if (config.detected) {
+		notes.push(`Found the design system through ${config.detected}.`);
+		const specifiers = new Set((config.imports ?? []).map((m) => m.specifier));
+		const tokens = (await tokenFiles(config)).map(relative);
+		if (specifiers.size > 1) notes.push(`"components" is left to zero config: apps import them by ${specifiers.size} specifiers from the package's exports (${[...specifiers].slice(0, 2).join(", ")}, …), which a config cannot spell.`);
+		else if (config.components.length > MAX_GLOBS) notes.push(`"components" is left to zero config: it found ${config.components.length} files through the package's exports, which it keeps following as the package changes.`);
+		else {
+			file.components = config.components;
+			if ([...specifiers][0]) file.importPath = [...specifiers][0];
+			const docs = config.docs.filter((d) => !DEFAULT_DOCS.includes(d));
+			if (docs.length) file.docs = [...DEFAULT_DOCS, ...docs];
+		}
+		if (tokens.length) file.tokens = tokens;
+	} else {
+		if (!ask) {
+			io.stderr(`init: zero config found no design system in ${root}. Pass --components (and --tokens) to say where it is, or run init in a terminal to answer a few questions. \`${NAME} inspect --explain\` shows what it looked at.`);
+			return 2;
+		}
+		io.stdout(`Zero config found no design system in ${root}.`);
+		let components = "";
+		for (let attempt = 0; attempt < 3 && !components; attempt++) {
+			const answer = (await ask("Where are the components? A glob from the root, e.g. src/components/ui/**/*.tsx: ")).trim();
+			if (!answer) continue;
+			if ((await componentFiles({
+				...config,
+				components: [answer]
+			})).length) components = answer;
+			else io.stdout(`No file matches ${answer}.`);
+		}
+		if (!components) {
+			io.stderr("init: no components given; nothing written.");
+			return 2;
+		}
+		file.components = [components];
+		const tokens = (await ask("Where are the tokens? A CSS or DTCG .json file, or leave it empty: ")).trim();
+		if (tokens) {
+			if (!fs.existsSync(path.resolve(root, tokens)) && !/[*?{]/.test(tokens)) io.stdout(`${tokens} does not exist; it is left out.`);
+			else file.tokens = [tokens];
+		}
+		const importPath = (await ask("How do apps import them? A package name such as @acme/ui, or leave it empty for tsconfig paths: ")).trim();
+		if (importPath) file.importPath = importPath;
+	}
+	const out = path.join(root, "onsystem.config.json");
+	fs.writeFileSync(out, `${JSON.stringify(file, null, 2)}\n`);
+	for (const note of notes) io.stdout(note);
+	io.stdout(`Wrote ${relativePath(io.cwd, out) || out}.`);
+	const checkIo = {
+		...io,
+		cwd: root
+	};
+	const dry = await runCheck([
+		"check",
+		".",
+		"--format",
+		"json",
+		...options.cache ? [] : ["--no-cache"]
+	], checkIo);
+	let results = [];
+	try {
+		results = JSON.parse(dry.stdout || "[]");
+	} catch {
+		io.stderr(`init: the dry run did not finish: ${dry.stderr.split("\n")[0] ?? ""}`);
+		return 1;
+	}
+	const byRule = /* @__PURE__ */ new Map();
+	let errors = 0;
+	let warnings = 0;
+	for (const result of results) for (const d of result.diagnostics) {
+		byRule.set(d.ruleId, (byRule.get(d.ruleId) ?? 0) + 1);
+		if (d.severity === "error") errors++;
+		else warnings++;
+	}
+	const flagged = results.filter((r) => r.diagnostics.length).length;
+	const total = errors + warnings;
+	io.stdout(total ? `Dry run of \`${NAME} check .\`: ${count$1(errors, "error")} and ${count$1(warnings, "warning")} in ${flagged} of ${count$1(results.length, "file")}. By rule: ${[...byRule].sort((a, b) => b[1] - a[1]).map(([rule, n]) => `${rule} ${n.toLocaleString("en-US")}`).join(", ")}.` : `Dry run of \`${NAME} check .\`: no problems in ${count$1(results.length, "file")}.`);
+	for (const line of dry.stderr.split("\n").filter(Boolean)) io.stdout(line);
+	const hasBaseline = [BASELINE_FILE, LEGACY_BASELINE_FILE].some((name) => fs.existsSync(path.join(root, name)));
+	if (total && !hasBaseline) {
+		const answer = options.yes ? "y" : ask ? (await ask(`Record these ${total.toLocaleString("en-US")} findings in ${BASELINE_FILE}, so check fails only on new ones? [Y/n] `)).trim().toLowerCase() : "n";
+		if (answer === "" || answer.startsWith("y")) {
+			const recorded = await runCheck([
+				"check",
+				".",
+				"--update-baseline",
+				...options.cache ? [] : ["--no-cache"]
+			], checkIo);
+			if (recorded.stdout) io.stdout(recorded.stdout);
+		} else io.stdout(`No baseline written; \`${NAME} check . --update-baseline\` records one later.`);
+	}
+	io.stdout(`Next: commit onsystem.config.json${total && !hasBaseline ? ` and ${BASELINE_FILE}` : ""}, and run \`npx ${NAME} check . --format github --require-design-system\` in CI.`);
+	return 0;
+}
+function count$1(n, word) {
+	return `${n.toLocaleString("en-US")} ${n === 1 ? word : `${word}s`}`;
+}
+//#endregion
+//#region src/cli.ts
+const DOCS = "https://design-system-mcp-demo.vercel.app/docs";
+const HELP = `${NAME} ${VERSION}
+
+Keeps coding agents on your React design system: checks UI code against your
+real components, props, variants and tokens in a Claude Code hook, in CI with
+check, and over MCP for any agent.
+
+Usage
+  onsystem [serve] [options]     Start the MCP server on stdio (default)
+  onsystem check <paths...>      Lint files, folders or globs with the check_ui rules
+                                 (for CI)
+  onsystem inspect               Print what was extracted from the project
+  onsystem init                  Write onsystem.config.json from what was found, run a
+                                 dry-run check and offer a baseline
+  onsystem help                  Show this help
+
+At a monorepo root with no design system of its own, every command works per
+project: each file is checked against the design system of the nearest folder
+with a config, components.json or package.json, and inspect lists every project.
+
+Options
+  --root <dir>            Project root (default: the config file's directory, or cwd)
+  --config <file>         Config file (default: onsystem.config.{json,ts,mjs,js})
+  --components <glob>     Component sources, repeatable (default: found through
+                          components.json or a workspace package, else
+                          components/ui/**/*.{tsx,jsx} and src/components/ui/...)
+  --tokens <file>         Token file (DTCG .json or CSS), repeatable
+  --docs <glob>           Component docs (Markdown/MDX), repeatable
+  --no-cache              Ignore the on-disk extraction cache
+  --no-watch              serve: do not reload when files change
+  --format <format>       check: pretty | json | github (default: pretty)
+  --max-warnings <n>      check: exit 1 when there are more than n warnings
+  --update-baseline       check: record the current findings as accepted, and exit 0
+  --baseline <file>       check: baseline file (default: ${BASELINE_FILE} in the root,
+                          used whenever it exists)
+  --ignore-baseline       check: report every finding, baseline or not
+  --include-design-system
+                          check: also lint the design system's own component
+                          files, which are skipped by default
+  --include-tests         check: also lint tests and stories (*.test.tsx,
+                          *.spec.tsx, *.stories.tsx) in folders and globs
+  --quiet-without-design-system
+                          check: print nothing and exit 0 when the project has no
+                          design-system components and no config (tokens alone
+                          are not a design system), for hooks installed across
+                          many projects
+  --require-design-system
+                          check: exit 2 when no components or no color tokens
+                          are found, so CI cannot pass by checking nothing
+  --explain               inspect: every candidate zero config looked at and why
+                          it was taken or not, the resolved config, unresolved
+                          tokens, and components whose props did not resolve
+  -y, --yes               init: write without asking, and record the baseline
+  --force                 init: replace an existing config file
+  -h, --help              Show this help
+  -v, --version           Show the version
+
+Examples
+  npx -y ${NAME} inspect --explain
+  npx -y ${NAME} init
+  npx -y ${NAME} check . --format github --require-design-system
+  npx -y ${NAME} check . --update-baseline   # adopt in an existing codebase
+
+Docs: ${DOCS}
+`;
+const defaultIo = {
+	cwd: process.cwd(),
+	stdout: (text) => process.stdout.write(`${text}\n`),
+	stderr: (text) => process.stderr.write(`${text}\n`),
+	color: process.stdout.isTTY && !process.env.NO_COLOR,
+	prompt: process.stdin.isTTY && process.stdout.isTTY ? askInTerminal : void 0
+};
+/** One question on the terminal, answered with a line. */
+async function askInTerminal(question) {
+	const rl = readline.createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		return await rl.question(question);
+	} finally {
+		rl.close();
+	}
+}
+/** Runs the CLI. Resolves to an exit code; `serve` resolves once the server is listening. */
+async function main(argv, io = defaultIo) {
+	let parsed;
+	try {
+		parsed = parseArgs({
+			args: argv,
+			allowPositionals: true,
+			allowNegative: true,
+			options: {
+				root: { type: "string" },
+				config: { type: "string" },
+				components: {
+					type: "string",
+					multiple: true
+				},
+				tokens: {
+					type: "string",
+					multiple: true
+				},
+				docs: {
+					type: "string",
+					multiple: true
+				},
+				cache: {
+					type: "boolean",
+					default: true
+				},
+				watch: {
+					type: "boolean",
+					default: true
+				},
+				format: {
+					type: "string",
+					default: "pretty"
+				},
+				"max-warnings": { type: "string" },
+				baseline: { type: "string" },
+				"update-baseline": {
+					type: "boolean",
+					default: false
+				},
+				"ignore-baseline": {
+					type: "boolean",
+					default: false
+				},
+				"quiet-without-design-system": {
+					type: "boolean",
+					default: false
+				},
+				"include-design-system": { type: "boolean" },
+				"include-tests": {
+					type: "boolean",
+					default: false
+				},
+				"require-design-system": {
+					type: "boolean",
+					default: false
+				},
+				explain: {
+					type: "boolean",
+					default: false
+				},
+				yes: {
+					type: "boolean",
+					short: "y",
+					default: false
+				},
+				force: {
+					type: "boolean",
+					default: false
+				},
+				help: {
+					type: "boolean",
+					short: "h"
+				},
+				version: {
+					type: "boolean",
+					short: "v"
+				}
+			}
+		});
+	} catch (error) {
+		io.stderr(`${error.message}\n\nRun ${NAME} --help for usage.`);
+		return 2;
+	}
+	const { values, positionals } = parsed;
+	if (values.help) {
+		io.stdout(HELP);
+		return 0;
+	}
+	if (values.version) {
+		io.stdout(VERSION);
+		return 0;
+	}
+	const [command = "serve", ...rest] = positionals;
+	if (command === "help") {
+		io.stdout(HELP);
+		return 0;
+	}
+	let root = values.root;
+	if (root !== void 0 && /\$\{[^}]*\}/.test(root)) {
+		io.stderr(`--root "${root}" holds a variable the client did not expand; using the working directory instead${command === "serve" ? ", or the client's roots when it holds no project" : ""}.`);
+		root = void 0;
+	}
+	const configOptions = {
+		cwd: io.cwd,
+		root,
+		config: values.config,
+		components: values.components,
+		tokens: values.tokens,
+		docs: values.docs,
+		includeDesignSystem: values["include-design-system"]
+	};
+	try {
+		switch (command) {
+			case "serve":
+				await serveStdio({
+					...configOptions,
+					cache: values.cache,
+					watch: values.watch,
+					logger: stderrLogger
+				});
+				return 0;
+			case "check": return await check(rest, configOptions, values, io);
+			case "inspect": return await inspect(configOptions, values, io);
+			case "init": return await init(configOptions, {
+				yes: values.yes,
+				force: values.force,
+				cache: values.cache
+			}, io, async (args, checkIo) => {
+				const out = [];
+				const err = [];
+				return {
+					code: await main(args, {
+						cwd: checkIo.cwd,
+						color: false,
+						stdout: (t) => out.push(t),
+						stderr: (t) => err.push(t)
+					}),
+					stdout: out.join("\n"),
+					stderr: err.join("\n")
+				};
+			});
+			default:
+				io.stderr(`Unknown command "${command}". Run ${NAME} --help for usage.`);
+				return 2;
+		}
+	} catch (error) {
+		if (error instanceof ConfigError) {
+			io.stderr(error.message);
+			return 2;
+		}
+		throw error;
+	}
+}
+async function check(patterns, configOptions, values, io) {
+	if (values["quiet-without-design-system"] && values["require-design-system"]) {
+		io.stderr("check: pass --quiet-without-design-system or --require-design-system, not both");
+		return 2;
+	}
+	if (!patterns.length) {
+		io.stderr(`check: pass files, folders or globs, e.g. ${NAME} check .`);
+		return 2;
+	}
+	const format = values.format;
+	if (![
+		"pretty",
+		"json",
+		"github"
+	].includes(format)) {
+		io.stderr(`check: unknown --format "${values.format}" (pretty, json, github)`);
+		return 2;
+	}
+	const maxWarnings = values["max-warnings"] === void 0 ? void 0 : Number(values["max-warnings"]);
+	if (maxWarnings !== void 0 && !Number.isInteger(maxWarnings)) {
+		io.stderr("check: --max-warnings expects an integer");
+		return 2;
+	}
+	const target = await loadTarget(configOptions);
+	warnDeprecated(target.config.deprecations, format, io);
+	const selection = target.workspace ? await selectInWorkspace(target.workspace, patterns, values, format, io) : await selectInProject(target.config, patterns, values, format, io);
+	if (typeof selection === "number") return selection;
+	const { files, notes } = selection;
+	if (!files.length) {
+		if (format === "json") io.stdout("[]");
+		else if (format === "pretty") {
+			const hints = [selection.skipped ? `Pass --include-design-system to check ${selection.skipped === 1 ? "it" : "them"}.` : "", selection.testsLeftOut ? "Pass --include-tests to check tests and stories." : ""].filter(Boolean);
+			io.stdout(`Nothing to check: ${notes.join("; ")}. ${hints.join(" ")}`.trimEnd());
+		}
+		return 0;
+	}
+	const update = values["update-baseline"];
+	const baselineFile = values.baseline ? path.resolve(io.cwd, values.baseline) : defaultBaseline(selection.root, values["ignore-baseline"] ? void 0 : (text) => {
+		warnDeprecated([text], format, io);
+	});
+	const baseline = values["ignore-baseline"] ? void 0 : readBaseline(baselineFile);
+	if (values.baseline && !update && !values["ignore-baseline"] && !baseline) {
+		io.stderr(`check: baseline not found: ${displayPath(io.cwd, baselineFile)}`);
+		return 2;
+	}
+	const disabledFor = (file) => {
+		const ds = selection.designSystemOf(file);
+		return new Set(Object.entries(rulesFor(ds.config, relativePath(ds.root, file))).filter(([, rule]) => rule.severity === "off").map(([id]) => id));
+	};
+	const disabledByKey = /* @__PURE__ */ new Map();
+	const realRoot = fs.realpathSync.native(selection.root);
+	const baselineKey = (file) => relativePath(realRoot, fs.realpathSync.native(file)).normalize("NFC");
+	const results = [];
+	const checked = /* @__PURE__ */ new Map();
+	let baselined = 0;
+	let fixed = 0;
+	for (const file of files) {
+		const code = await fs$1.readFile(file, "utf8");
+		const ds = selection.designSystemOf(file);
+		let result = ds.check(code, relativePath(ds.root, file));
+		const key = baselineKey(file);
+		const disabled = disabledFor(file);
+		disabledByKey.set(key, disabled);
+		if (update) checked.set(key, result.diagnostics);
+		if (baseline && !update) {
+			const match = applyBaseline(baseline, key, result, disabled);
+			result = {
+				...match.result,
+				baselined: match.baselined
+			};
+			baselined += match.baselined;
+			fixed += match.fixed;
+		}
+		results.push({
+			...result,
+			file: relativePath(io.cwd, file)
+		});
+	}
+	const elsewhere = results.filter((r) => r.skipped).length;
+	if (elsewhere) notes.push(`${plural(elsewhere, "image or email file")} not checked`);
+	const unchecked = uncheckedNotice(results);
+	if (update) {
+		const next = updateBaseline(baseline, checked, realRoot, (key) => disabledByKey.get(key) ?? /* @__PURE__ */ new Set());
+		writeBaseline(baselineFile, next);
+		const counts = countBaseline(next);
+		io.stdout(`Baseline: ${count(counts.findings, "finding")} in ${count(counts.files, "file")} → ${displayPath(io.cwd, baselineFile)}`);
+		for (const text of selection.notices) io.stderr(text);
+		if (unchecked) io.stderr(unchecked);
+		return 0;
+	}
+	const output = formatDiagnostics(format === "json" ? results : results.filter((r) => !r.skipped), format, {
+		color: io.color,
+		baselined: baseline ? baselined : void 0,
+		notes,
+		fixedHint: fixed ? `${count(fixed, "baseline finding")} no longer ${fixed === 1 ? "occurs" : "occur"}: run \`check ${patterns.map(shellQuote).join(" ")} --update-baseline\` to drop ${fixed === 1 ? "it" : "them"}.` : void 0
+	});
+	if (output) io.stdout(output);
+	for (const text of [...selection.notices, unchecked]) {
+		if (!text) continue;
+		if (format === "pretty") io.stdout(text);
+		else if (format === "github") io.stdout(`::warning title=${NAME}::${text}`);
+		else io.stderr(text);
+	}
+	const errors = results.reduce((n, r) => n + r.errorCount, 0);
+	const warnings = results.reduce((n, r) => n + r.warningCount, 0);
+	if (errors > 0) return 1;
+	if (maxWarnings !== void 0 && warnings > maxWarnings) {
+		if (format === "pretty") io.stderr(`Too many warnings (${warnings}, max ${maxWarnings}).`);
+		return 1;
+	}
+	return 0;
+}
+/** Splits the patterns into files named outright and globs (a folder: every TSX/JSX file under it). */
+function expandPatterns(patterns, cwd) {
+	const named = [];
+	const globs = [];
+	for (const pattern of patterns) {
+		const stat = fs.statSync(path.resolve(cwd, pattern), { throwIfNoEntry: false });
+		if (stat && !stat.isDirectory()) {
+			named.push(path.resolve(cwd, pattern));
+			continue;
+		}
+		const literal = stat ? escapePath(toPosix(path.join(pattern, "."))) : toPosix(pattern);
+		globs.push(!stat ? literal : literal === "." ? "**/*.{tsx,jsx}" : `${literal}/**/*.{tsx,jsx}`);
+	}
+	return {
+		named,
+		globs
+	};
+}
+/** One project: the root's config and design system for every file. */
+async function selectInProject(config, patterns, values, format, io) {
+	const ds = await loadDesignSystem(config, {
+		cache: values.cache,
+		logger: silentLogger
+	});
+	const { named, globs } = expandPatterns(patterns, io.cwd);
+	const options = {
+		cwd: io.cwd,
+		absolute: true,
+		expandDirectories: false
+	};
+	const all = globs.length ? await findFiles(globs, {
+		...options,
+		ignore: ["**/node_modules/**"]
+	}) : [];
+	const excludes = config.exclude.filter((e) => !(values["include-tests"] && isTestPattern(e))).map((e) => excludeFromCwd(e, config.root, io.cwd)).filter((e) => e !== void 0);
+	const kept = globs.length ? await findFiles(globs, {
+		...options,
+		ignore: unique(["**/node_modules/**", ...excludes])
+	}) : [];
+	const ignored = gitIgnored(io.cwd, kept);
+	const keptSet = new Set(kept);
+	const leftOut = all.filter((file) => !keptSet.has(file));
+	const left = {
+		tests: leftOut.filter((file) => TEST_FILE.test(file)).length,
+		excluded: leftOut.filter((file) => !TEST_FILE.test(file)).length,
+		gitignored: ignored.size
+	};
+	let files = unique([...named, ...kept.filter((file) => !ignored.has(file))]).sort();
+	if (!files.length && !all.length) {
+		io.stderr(`check: no files match ${patterns.join(" ")}`);
+		return 2;
+	}
+	if (values["quiet-without-design-system"] && !config.configFile && !ds.components.length) {
+		if (format === "json") io.stdout("[]");
+		return 0;
+	}
+	const notice = ds.notice();
+	if (notice && values["require-design-system"]) {
+		io.stderr(`check --require-design-system: ${notice}`);
+		return 2;
+	}
+	let skipped = 0;
+	if (!config.includeDesignSystem) {
+		const own = new Set((await componentFiles(config)).map(realPath));
+		const rest = files.filter((file) => !own.has(realPath(file)));
+		skipped = files.length - rest.length;
+		files = rest;
+	}
+	return {
+		files,
+		designSystemOf: () => ds,
+		root: ds.root,
+		notes: scopeNotes(skipped, left),
+		notices: notice ? [notice] : [],
+		skipped,
+		testsLeftOut: left.tests
+	};
+}
+/**
+* A workspace root: each file is checked by the design system of its own project, the
+* nearest folder with a config, a components.json or a package.json, with that project's
+* config, exactly as `check` from that folder (and the Claude Code hook) would check it.
+*/
+async function selectInWorkspace(workspace, patterns, values, format, io) {
+	const { named, globs } = expandPatterns(patterns, io.cwd);
+	const all = globs.length ? await findFiles(globs, {
+		cwd: io.cwd,
+		absolute: true,
+		expandDirectories: false,
+		ignore: ["**/node_modules/**"]
+	}) : [];
+	const projectOf = /* @__PURE__ */ new Map();
+	for (const file of unique([...named, ...all])) projectOf.set(file, await workspace.projectFor(file));
+	const project = (file) => {
+		const found = projectOf.get(file);
+		if (!found) throw new Error(`No project for ${file}`);
+		return found;
+	};
+	const designSystems = /* @__PURE__ */ new Map();
+	const load = (p) => {
+		let ds = designSystems.get(p.root);
+		if (!ds) {
+			ds = loadDesignSystem(p.config, {
+				cache: values.cache,
+				logger: silentLogger
+			});
+			designSystems.set(p.root, ds);
+		}
+		return ds;
+	};
+	const leftOut = all.filter((file) => {
+		const { root, config } = project(file);
+		const relative = relativePath(root, file);
+		return config.exclude.some((e) => !(values["include-tests"] && isTestPattern(e)) && matchesGlob(relative, e));
+	});
+	const leftOutSet = new Set(leftOut);
+	const kept = all.filter((file) => !leftOutSet.has(file));
+	const ignored = gitIgnored(io.cwd, kept);
+	const left = {
+		tests: leftOut.filter((file) => TEST_FILE.test(file)).length,
+		excluded: leftOut.filter((file) => !TEST_FILE.test(file)).length,
+		gitignored: ignored.size
+	};
+	let files = unique([...named, ...kept.filter((file) => !ignored.has(file))]).sort();
+	if (!files.length && !all.length) {
+		io.stderr(`check: no files match ${patterns.join(" ")}`);
+		return 2;
+	}
+	const loaded = /* @__PURE__ */ new Map();
+	for (const p of unique(files.map(project))) loaded.set(p.root, await load(p));
+	const designSystemOf = (file) => {
+		const ds = loaded.get(project(file).root);
+		if (!ds) throw new Error(`No design system loaded for ${file}`);
+		return ds;
+	};
+	if (values["quiet-without-design-system"]) {
+		files = files.filter((file) => Boolean(project(file).config.configFile) || designSystemOf(file).components.length > 0);
+		if (!files.length) {
+			if (format === "json") io.stdout("[]");
+			return 0;
+		}
+	}
+	if (values["require-design-system"]) {
+		let complete = false;
+		for (const p of workspace.projects) if (!(await load(p)).notice()) {
+			complete = true;
+			break;
+		}
+		if (!complete) {
+			const packages = workspace.projects.length + workspace.others.length;
+			io.stderr(`check --require-design-system: no workspace package has a design system with components and color tokens (${plural(packages, "package")} looked at). See ${DOCS}/troubleshooting`);
+			return 2;
+		}
+	}
+	const own = /* @__PURE__ */ new Map();
+	for (const p of unique(files.map(project))) {
+		if (p.config.includeDesignSystem) continue;
+		own.set(p.root, new Set((await componentFiles(p.config)).map(realPath)));
+	}
+	const rest = files.filter((file) => !own.get(project(file).root)?.has(realPath(file)));
+	const skipped = files.length - rest.length;
+	files = rest;
+	const gaps = /* @__PURE__ */ new Map();
+	for (const p of unique(files.map(project))) {
+		const ds = loaded.get(p.root);
+		const notice = ds?.notice();
+		if (!ds || !notice) continue;
+		const gap = gaps.get(notice) ?? {
+			ds,
+			dirs: []
+		};
+		gap.dirs.push(p.dir);
+		gaps.set(notice, gap);
+	}
+	const notices = [...gaps.values()].map(({ ds, dirs }) => ds.notice(listOf(dirs)) ?? "");
+	const used = unique(files.map((file) => project(file).root)).length;
+	return {
+		files,
+		designSystemOf,
+		root: workspace.root,
+		notes: [...used > 1 ? [plural(used, "project")] : [], ...scopeNotes(skipped, left)],
+		notices: notices.filter(Boolean),
+		skipped,
+		testsLeftOut: left.tests
+	};
+}
+/** `apps/web`, `apps/web and packages/ui`, `a, b, c and 4 more`. */
+function listOf(items, max = 3) {
+	if (items.length <= 1) return items[0] ?? "";
+	if (items.length <= max) return `${items.slice(0, -1).join(", ")} and ${items.at(-1) ?? ""}`;
+	return `${items.slice(0, max).join(", ")} and ${items.length - max} more`;
+}
+async function inspect(configOptions, values, io) {
+	const target = await loadTarget(configOptions);
+	const { config } = target;
+	warnDeprecated(config.deprecations, "pretty", io);
+	if (target.workspace) return inspectWorkspace(target.workspace, values, io);
+	const ds = await loadDesignSystem(config, {
+		cache: values.cache,
+		logger: silentLogger
+	});
+	const { model } = ds;
+	if (values.format === "json") {
+		io.stdout(JSON.stringify(model, null, 2));
+		return 0;
+	}
+	const lines = [
+		`root     ${model.root}`,
+		`config   ${config.configFile ? displayPath(io.cwd, config.configFile) : "(defaults)"}`,
+		...config.detected ? [`detected ${config.detected}`] : [],
+		`files    ${plural(model.stats.files.components, "component file")}, ${plural(model.stats.files.tokens, "token file")}, ${plural(model.stats.files.docs, "doc")}`,
+		`time     ${model.stats.durationMs}ms${model.stats.fromCache ? " (cache)" : ""}`,
+		"",
+		`Components (${ds.roots().length} + ${model.components.length - ds.roots().length} parts)`
+	];
+	for (const c of ds.roots()) {
+		const variants = c.variants.map((v) => `${v.name}[${v.values.length}]`).join(" ");
+		const meta = [
+			c.element ? `<${c.element}>` : "",
+			plural(c.props.length, "prop"),
+			variants,
+			c.subcomponents.length ? plural(c.subcomponents.length, "part") : "",
+			c.docs ? "docs" : "",
+			plural(c.examples.length, "example")
+		].filter(Boolean);
+		lines.push(`  ${c.name.padEnd(18)} ${meta.join(" · ")}`);
+	}
+	lines.push("", `Tokens (${model.tokens.length})`);
+	for (const [category, n] of tokenCounts(model)) lines.push(`  ${category.padEnd(18)} ${n}`);
+	if (model.warnings.length) {
+		lines.push("", "Warnings");
+		for (const warning of model.warnings) lines.push(`  ${warning}`);
+	}
+	if (values.explain) lines.push("", ...explainProject(ds, io.cwd));
+	io.stdout(lines.join("\n"));
+	return 0;
+}
+function tokenCounts(model) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const t of model.tokens) counts.set(t.category, (counts.get(t.category) ?? 0) + 1);
+	return counts;
+}
+/** Every project of a workspace root, with what was found in each, and the packages without one. */
+async function inspectWorkspace(workspace, values, io) {
+	const loaded = [];
+	for (const project of workspace.projects) loaded.push({
+		project,
+		ds: await loadDesignSystem(project.config, {
+			cache: values.cache,
+			logger: silentLogger
+		})
+	});
+	if (values.format === "json") {
+		io.stdout(JSON.stringify({
+			root: workspace.root,
+			workspace: workspace.source,
+			projects: loaded.map(({ project, ds }) => ({
+				dir: project.dir,
+				...project.name ? { name: project.name } : {},
+				...project.config.configFile ? { config: relativePath(workspace.root, project.config.configFile) } : {},
+				...project.config.detected ? { detected: project.config.detected } : {},
+				model: ds.model
+			})),
+			others: workspace.others
+		}, null, 2));
+		return 0;
+	}
+	const packages = workspace.projects.length + workspace.others.length;
+	const lines = [
+		`root      ${workspace.root}`,
+		`workspace ${plural(packages, "package")} (${workspace.source}), ${plural(workspace.projects.length, "project")} with a design system`,
+		`config    ${workspace.configFile ? displayPath(io.cwd, workspace.configFile) : "(defaults)"}`
+	];
+	for (const { project, ds } of loaded) {
+		const { model } = ds;
+		const roots = ds.roots();
+		const tokens = [...tokenCounts(model)].map(([category, n]) => `${category} ${n}`);
+		const own = project.config.configFile && project.config.configFile !== workspace.configFile ? displayPath(workspace.root, project.config.configFile) : void 0;
+		lines.push("", `${project.dir}${project.name ? ` (${project.name})` : ""}`, ...own ? [`  config     ${own}`] : [], ...project.config.detected ? [`  detected   ${project.config.detected}`] : [], `  files      ${plural(model.stats.files.components, "component file")}, ${plural(model.stats.files.tokens, "token file")}, ${plural(model.stats.files.docs, "doc")}`, `  components ${roots.length} + ${model.components.length - roots.length} parts${roots.length ? `: ${listNames(roots.map((c) => c.name))}` : ""}`, `  tokens     ${tokens.length ? tokens.join(", ") : "none"}`, ...model.warnings.length ? [`  warnings   ${model.warnings.length}: ${model.warnings[0] ?? ""}`] : []);
+	}
+	if (!loaded.length) lines.push("", `No workspace package has a design system that zero config finds. See ${DOCS}/troubleshooting`);
+	if (workspace.others.length) lines.push("", `Without a design system (${workspace.others.length}): ${listNames(workspace.others)}`);
+	lines.push("", `Each file is checked by its project's design system. For one project's components, tokens and warnings: ${NAME} inspect --root <folder>`);
+	if (values.explain) lines.push("", ...explainWorkspace(workspace, loaded, io.cwd));
+	io.stdout(lines.join("\n"));
+	return 0;
+}
+/** Why the root is read as a monorepo, then each project's explanation. */
+function explainWorkspace(workspace, loaded, cwd) {
+	const { rootConfig } = workspace;
+	const steps = [];
+	detectProject(rootConfig.root, rootConfig.tsconfig, steps);
+	const lines = [
+		`Why this is read as a monorepo root: it declares workspace packages (${workspace.source}), no config there sets components, and zero config finds no design system in the root itself:`,
+		...steps.map((s) => `  ${(s.accepted ? "found" : "no").padEnd(6)} ${s.candidate}: ${s.reason}`),
+		`  no     ${rootConfig.components.join(", ")}: no file matches`
+	];
+	for (const { project, ds } of loaded) lines.push("", `${project.dir}${project.name ? ` (${project.name})` : ""}`, ...explainProject(ds, cwd, "  "));
+	return lines;
+}
+/** `A, B, C` up to a dozen names, then `and 40 more`. */
+function listNames(names, max = 12) {
+	const shown = names.slice(0, max).join(", ");
+	return names.length > max ? `${shown} and ${names.length - max} more` : shown;
+}
+/**
+* Says once what a file's old name means: on stderr, or as a workflow warning with
+* `--format github` so it shows on the run. Never on stdout otherwise, which JSON output owns.
+*/
+function warnDeprecated(messages, format, io) {
+	for (const text of messages ?? []) if (format === "github") io.stdout(`::warning title=${NAME}::${text}`);
+	else io.stderr(text);
+}
+/**
+* The baseline in the root: `onsystem.baseline.json`, or one still under its name from
+* before the rename, which is read (and updated) where it is, with a notice to rename it.
+*/
+function defaultBaseline(root, warn) {
+	const current = path.join(root, BASELINE_FILE);
+	const legacy = path.join(root, LEGACY_BASELINE_FILE);
+	if (!fs.existsSync(legacy)) return current;
+	if (fs.existsSync(current)) {
+		warn?.(`${LEGACY_BASELINE_FILE} is ignored: ${BASELINE_FILE} is read instead. Delete ${LEGACY_BASELINE_FILE}.`);
+		return current;
+	}
+	warn?.(`${LEGACY_BASELINE_FILE} is the baseline's name from before design-system-mcp became onsystem. Rename it to ${BASELINE_FILE} (git mv ${LEGACY_BASELINE_FILE} ${BASELINE_FILE}); the old name still works for now.`);
+	return legacy;
+}
+/** Tests and stories, which `check` leaves out of folders and globs unless asked. */
+const TEST_FILE = /\.(?:test|spec|stories)\.[cm]?[jt]sx?$|[\\/]__(?:tests|stories|mocks)__[\\/]/;
+/** The default patterns `--include-tests` lifts. */
+function isTestPattern(pattern) {
+	return pattern === "**/*.{test,spec,stories}.{ts,tsx,js,jsx}" || pattern === "**/__{tests,stories,mocks}__/**";
+}
+/** What a run left out, for the summary line: `5 design-system files skipped`. */
+function scopeNotes(skipped, left) {
+	return [
+		skipped ? `${plural(skipped, "design-system file")} skipped` : "",
+		left.tests ? `${left.tests.toLocaleString("en-US")} ${left.tests === 1 ? "test or story" : "tests and stories"} left out` : "",
+		left.excluded ? `${plural(left.excluded, "excluded file")} left out` : "",
+		left.gitignored ? `${plural(left.gitignored, "file")} git ignores left out` : ""
+	].filter(Boolean);
+}
+/**
+* A config `exclude` pattern, relative to the root, as a pattern relative to the
+* working directory the globs run from; undefined when it only covers files
+* outside that directory. `**\/` patterns hold anywhere.
+*/
+function excludeFromCwd(pattern, root, cwd) {
+	if (pattern.startsWith("**/")) return pattern;
+	const fromRoot = toPosix(path.relative(root, cwd));
+	if (!fromRoot) return pattern;
+	if (fromRoot.startsWith("..")) return toPosix(path.join(path.relative(cwd, root), pattern));
+	return pattern.startsWith(`${fromRoot}/`) ? pattern.slice(fromRoot.length + 1) : void 0;
+}
+/**
+* Files a glob matches, as Node spells absolute paths (with backslashes on Windows, where
+* tinyglobby gives forward slashes), so they compare equal to `path.resolve` and git's.
+*/
+async function findFiles(globs, options) {
+	return (await glob(globs, options)).map((file) => path.resolve(file));
+}
+/**
+* The files git ignores, through `git check-ignore`: nested .gitignore files,
+* `.git/info/exclude` and tracked-file exceptions, exactly as git reads them.
+* Outside a repository, or without git, nothing is ignored.
+*/
+function gitIgnored(cwd, files) {
+	if (!files.length) return /* @__PURE__ */ new Set();
+	const result = spawnSync("git", [
+		"check-ignore",
+		"-z",
+		"--stdin"
+	], {
+		cwd,
+		input: files.join("\0"),
+		encoding: "utf8",
+		maxBuffer: 268435456,
+		windowsHide: true
+	});
+	if (result.status !== 0 || typeof result.stdout !== "string") return /* @__PURE__ */ new Set();
+	return new Set(result.stdout.split("\0").filter(Boolean).map((file) => path.resolve(cwd, file)));
+}
+/** `1,307 findings`. */
+function count(n, word) {
+	return `${n.toLocaleString("en-US")} ${n === 1 ? word : `${word}s`}`;
+}
+/** Quotes a pattern for the hint when the shell would expand or split it. */
+function shellQuote(pattern) {
+	return /^[\w./@-]+$/.test(pattern) ? pattern : `"${pattern.replace(/(["\\$`])/g, "\\$1")}"`;
+}
+/** The file's real path, so a linked root or a differently spelled path matches. */
+function realPath(file) {
+	try {
+		return fs.realpathSync.native(file);
+	} catch {
+		return file;
+	}
+}
+/** Relative to cwd when the file is below it, absolute otherwise. */
+function displayPath(cwd, file) {
+	const rel = path.relative(cwd, file);
+	return rel && !rel.startsWith("..") && !path.isAbsolute(rel) ? rel : file;
+}
+//#endregion
+//#region src/bin.ts
+main(process.argv.slice(2)).then((code) => {
+	process.exitCode = code;
+}, (error) => {
+	process.stderr.write(`${error.stack ?? String(error)}\n`);
+	process.exitCode = 1;
+});
+//#endregion
+export {};