export const command = (
  cmd: string,
  args: ReadonlyArray<string> = [],
  options?: CommandOptions,
): ((token: string) => ChildProcess.Command) => {
  const injection: TokenInjection = options?.token ?? "env";
  const {
    token: _tokenMode,
    env: baseEnv,
    extendEnv,
    ...rest
  } = options ?? {};
  return (clearToken: string) => {
    const argv =
      injection === "argv" || injection === "both"
        ? [...args, clearToken]
        : [...args];
    const env =
      injection === "env" || injection === "both"
        ? { ...(baseEnv ?? {}), [ASSUME_TOKEN_ENV]: clearToken }
        : baseEnv;
    return ChildProcess.make(cmd, argv, {
      ...rest,
      ...(env !== undefined ? { env } : {}),
      // Default merge with process env so PATH / etc. survive token injection.
      extendEnv: extendEnv ?? true,
    });
  };
};