@1aboveio/skills 1.0.7 → 1.0.9

package/skills/engineering/resolve-release/scripts/plan.test.mjs

@@ -1,428 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
-import { createHash } from 'node:crypto'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { spawnSync } from 'node:child_process'
-import {
-  bumpFor,
-  classifySubject,
-  latestReleaseTag,
-  nextReleaseCandidateTag,
-  nextVersion,
-  parseSemver,
-  planRelease,
-  renderChangelog,
-} from './plan.mjs'
-
-function git(cwd, args) {
-  const result = spawnSync('git', args, { cwd, encoding: 'utf8' })
-  assert.equal(result.status, 0, result.stderr)
-  return result.stdout
-}
-
-function repo() {
-  const cwd = mkdtempSync(join(tmpdir(), 'rush-release-plan-'))
-  git(cwd, ['init', '-b', 'main'])
-  git(cwd, ['config', 'user.email', 'dev@example.com'])
-  git(cwd, ['config', 'user.name', 'Dev'])
-  git(cwd, ['config', 'commit.gpgsign', 'false'])
-  writeFileSync(join(cwd, 'package.json'), `${JSON.stringify({ name: 'demo', version: '1.2.0' }, null, 2)}\n`)
-  git(cwd, ['add', 'package.json'])
-  git(cwd, ['commit', '-m', 'chore: init'])
-  git(cwd, ['tag', 'v1.2.0'])
-  return cwd
-}
-
-test('semver helpers', () => {
-  assert.deepEqual(parseSemver('v1.2.3'), { major: 1, minor: 2, patch: 3 })
-  assert.equal(parseSemver('v1.2.3-rc.1'), null)
-  assert.equal(latestReleaseTag(['v1.2.0', 'v1.10.0', 'v1.2.3-rc.1']).tag, 'v1.10.0')
-  assert.deepEqual(nextVersion({ major: 1, minor: 2, patch: 3 }, 'minor'), { major: 1, minor: 3, patch: 0 })
-  assert.equal(nextReleaseCandidateTag('v1.3.0', []), 'v1.3.0-rc.1')
-  assert.equal(nextReleaseCandidateTag('v1.3.0', ['v1.3.0-rc.1', 'v1.3.0-rc.3']), 'v1.3.0-rc.4')
-})
-
-test('conventional commits drive the bump, with 0.x breaking as minor', () => {
-  const feat = [classifySubject('feat(api): list invoices')]
-  const fix = [classifySubject('fix: null guard')]
-  const breaking = [classifySubject('feat!: drop v1')]
-  assert.equal(bumpFor(feat, { major: 1, minor: 2, patch: 0 }).bump, 'minor')
-  assert.equal(bumpFor(fix, { major: 1, minor: 2, patch: 0 }).bump, 'patch')
-  assert.equal(bumpFor(breaking, { major: 1, minor: 2, patch: 0 }).bump, 'major')
-  assert.equal(bumpFor(breaking, { major: 0, minor: 9, patch: 0 }).bump, 'minor')
-  assert.equal(bumpFor(breaking, { major: 0, minor: 9, patch: 0 }, { strict: true }).bump, 'major')
-})
-
-test('changelog groups notable commits and skips internals', () => {
-  const md = renderChangelog({
-    version: '1.3.0',
-    date: '2026-08-24',
-    changes: [
-      classifySubject('feat: add export'),
-      classifySubject('fix: timezone'),
-      classifySubject('chore: ignore me'),
-    ],
-  })
-  assert.match(md, /## \[1\.3\.0\] - 2026-08-24/)
-  assert.match(md, /### Added\n- add export/)
-  assert.match(md, /### Fixed\n- timezone/)
-  assert.doesNotMatch(md, /ignore me/)
-})
-
-test('planRelease reads git history from the frozen SHA', () => {
-  const cwd = repo()
-  writeFileSync(join(cwd, 'a.txt'), 'a\n')
-  git(cwd, ['add', 'a.txt'])
-  git(cwd, ['commit', '-m', 'feat: export csv'])
-  const sha = git(cwd, ['rev-parse', 'HEAD']).trim()
-  writeFileSync(join(cwd, 'package.json'), `${JSON.stringify({ name: 'demo', version: '9.0.0' }, null, 2)}\n`)
-  git(cwd, ['add', 'package.json'])
-  git(cwd, ['commit', '-m', 'feat!: should not count if SHA is frozen earlier'])
-  const plan = planRelease({ sha, cwd, now: new Date('2026-08-24T00:00:00Z') })
-  assert.equal(plan.baselineTag, 'v1.2.0')
-  assert.equal(plan.currentVersion, '1.2.0')
-  assert.equal(plan.bump, 'minor')
-  assert.equal(plan.nextVersion, '1.3.0')
-  assert.equal(plan.tag, 'v1.3.0')
-  assert.deepEqual(plan.versionFiles, ['package.json'])
-  assert.match(plan.changelogMarkdown, /export csv/)
-  assert.doesNotMatch(plan.changelogMarkdown, /should not count/)
-})
-
-test('Cloud Run plan reserves the next unused immutable candidate tag', () => {
-  const cwd = repo()
-  writeFileSync(join(cwd, 'a.txt'), 'a\n')
-  git(cwd, ['add', 'a.txt'])
-  git(cwd, ['commit', '-m', 'feat: export csv'])
-  const sha = git(cwd, ['rev-parse', 'HEAD']).trim()
-  git(cwd, ['tag', 'v1.3.0-rc.1'])
-  git(cwd, ['tag', 'v1.3.0-rc.2'])
-
-  const plan = planRelease({ sha, cloudRun: true, cwd, now: new Date('2026-08-24T00:00:00Z') })
-
-  assert.equal(plan.tag, 'v1.3.0')
-  assert.equal(plan.candidateTag, 'v1.3.0-rc.3')
-})
-
-test('planRelease ignores higher tags that are not reachable from the frozen SHA', () => {
-  const cwd = repo()
-  const candidate = git(cwd, ['rev-parse', 'HEAD']).trim()
-  git(cwd, ['switch', '-c', 'unrelated'])
-  writeFileSync(join(cwd, 'side.txt'), 'side\n')
-  git(cwd, ['add', 'side.txt'])
-  git(cwd, ['commit', '-m', 'feat: unrelated branch'])
-  git(cwd, ['tag', 'v9.0.0'])
-  git(cwd, ['switch', 'main'])
-
-  const plan = planRelease({ sha: candidate, cwd, now: new Date('2026-08-24T00:00:00Z') })
-  assert.equal(plan.baselineTag, 'v1.2.0')
-  assert.equal(plan.currentVersion, '1.2.0')
-  assert.equal(plan.nextVersion, '1.2.1')
-})
-
-test('planRelease uses the repository release identity when the private root package has no version', () => {
-  const cwd = mkdtempSync(join(tmpdir(), 'rush-release-distribution-plan-'))
-  git(cwd, ['init', '-b', 'main'])
-  git(cwd, ['config', 'user.email', 'dev@example.com'])
-  git(cwd, ['config', 'user.name', 'Dev'])
-  git(cwd, ['config', 'commit.gpgsign', 'false'])
-  mkdirSync(join(cwd, 'skills/distribution'), { recursive: true })
-  writeFileSync(join(cwd, 'package.json'), `${JSON.stringify({ name: 'private-root', private: true }, null, 2)}\n`)
-  writeFileSync(join(cwd, 'skills/distribution/manifest.json'), `${JSON.stringify({
-    releaseVersion: '0.19.0',
-    sources: [{
-      id: 'first-party',
-      renderTargets: [
-        { id: 'private-checkout', revision: 'main' },
-      ],
-    }],
-  }, null, 2)}\n`)
-  git(cwd, ['add', '.'])
-  git(cwd, ['commit', '-m', 'chore: release 0.19.0'])
-  git(cwd, ['tag', 'v0.19.0'])
-  writeFileSync(join(cwd, 'change.txt'), 'manual trigger only\n')
-  git(cwd, ['add', 'change.txt'])
-  git(cwd, ['commit', '-m', 'fix: make coverage skills manual only'])
-
-  const plan = planRelease({
-    sha: git(cwd, ['rev-parse', 'HEAD']).trim(),
-    cwd,
-    now: new Date('2026-08-30T00:00:00Z'),
-  })
-
-  assert.equal(plan.currentVersion, '0.19.0')
-  assert.equal(plan.nextVersion, '0.19.1')
-  assert.deepEqual(plan.versionFiles, ['skills/distribution/manifest.json'])
-})
-
-// rush-release never passes --dark-flags, so its plan must be exactly what it was before
-// dark launch existed: no darkFlags key and an unchanged changelog.
-test('a plan without dark flags carries no dark-launch trace', () => {
-  const cwd = repo()
-  git(cwd, ['commit', '--allow-empty', '-m', 'feat: export csv'])
-  const plan = planRelease({ sha: 'HEAD', cwd, now: new Date('2026-08-24T00:00:00Z') })
-  assert.equal('darkFlags' in plan, false)
-  assert.equal(plan.changelogMarkdown, '## [1.3.0] - 2026-08-24\n\n### Added\n- export csv\n')
-})
-
-test('dark flags add a Shipped dark changelog section and keep the bump', () => {
-  const cwd = repo()
-  git(cwd, ['commit', '--allow-empty', '-m', 'feat: bulk refunds'])
-  const darkFlags = [{ name: 'bulk-refunds', summary: 'Bulk refunds' }]
-  const plan = planRelease({ sha: 'HEAD', cwd, darkFlags, now: new Date('2026-08-24T00:00:00Z') })
-  assert.equal(plan.bump, 'minor')
-  assert.deepEqual(plan.darkFlags, darkFlags)
-  assert.equal(plan.changelogMarkdown,
-    '## [1.3.0] - 2026-08-24\n\n### Added\n- bulk refunds\n\n### Shipped dark\n- Bulk refunds (flag `bulk-refunds`, off)\n')
-})
-
-test('the CLI reads dark flags from a dark-flags.mjs list file and rejects malformed ones', () => {
-  const cwd = repo()
-  git(cwd, ['commit', '--allow-empty', '-m', 'fix: rounding'])
-  const good = join(cwd, 'flags.json')
-  writeFileSync(good, JSON.stringify({ flags: [{ name: 'new-checkout', summary: 'New checkout', default: false }], errors: [] }))
-  const script = join(import.meta.dirname, 'plan.mjs')
-  const ok = spawnSync('node', [script, '--sha', 'HEAD', '--json', '--dark-flags', good], { cwd, encoding: 'utf8' })
-  assert.equal(ok.status, 0, ok.stderr)
-  assert.deepEqual(JSON.parse(ok.stdout).darkFlags, [{ name: 'new-checkout', summary: 'New checkout' }])
-  const bad = join(cwd, 'bad.json')
-  writeFileSync(bad, JSON.stringify([{ name: 'no-summary' }]))
-  const refused = spawnSync('node', [script, '--sha', 'HEAD', '--dark-flags', bad], { cwd, encoding: 'utf8' })
-  assert.equal(refused.status, 2)
-  assert.match(refused.stderr, /name, summary/)
-})
-
-function preparedRepo(t, { productCut = false, badLockCut = false, python = false, badPackageCut = false } = {}) {
-  const cwd = repo()
-  const remote = mkdtempSync(join(tmpdir(), 'prepared-release-origin-'))
-  t.after(() => { rmSync(cwd, { recursive: true, force: true }); rmSync(remote, { recursive: true, force: true }) })
-  git(remote, ['init', '--bare'])
-  // Exercise git's real transport while keeping the canonical origin identity offline.
-  git(cwd, ['remote', 'add', 'origin', 'https://github.com/example/demo.git'])
-  git(cwd, ['config', `url.${remote}.insteadOf`, 'https://github.com/example/demo.git'])
-  const lock = (version) => ({ name: 'demo', version, lockfileVersion: 3, packages: { '': { name: 'demo', version } } })
-  writeFileSync(join(cwd, 'package-lock.json'), JSON.stringify(lock('1.2.0')))
-  writeFileSync(join(cwd, 'VERSION'), '1.2.0\n')
-  if (python) writeFileSync(join(cwd, 'pyproject.toml'), '[project]\nname = "demo"\nversion = "1.2.0"\n\n[tool.other]\nversion = "not-a-release"\n')
-  writeFileSync(join(cwd, 'CHANGELOG.md'), '# Changelog\n\n## [1.2.0] - 2026-08-01\n\n- Previous release.\n')
-  git(cwd, ['add', '.'])
-  git(cwd, ['commit', '-m', 'chore: existing identities'])
-  git(cwd, ['switch', '-c', 'old-metadata'])
-  writeFileSync(join(cwd, 'package.json'), JSON.stringify({ name: 'demo', version: '1.3.0', ...(badPackageCut ? { scripts: { build: 'execute-unreviewed-code' } } : {}) }))
-  const cutLock = lock('1.3.0')
-  if (badLockCut) cutLock.packages['node_modules/unsafe'] = { version: '9.0.0' }
-  writeFileSync(join(cwd, 'package-lock.json'), JSON.stringify(cutLock))
-  writeFileSync(join(cwd, 'VERSION'), '1.3.0\n')
-  if (python) writeFileSync(join(cwd, 'pyproject.toml'), '[project]\nname = "demo"\nversion = "1.3.0"\n\n[tool.other]\nversion = "not-a-release"\n')
-  const original = '## [1.3.0] - 2026-08-24\n\n### Added\n- Original notes.\n'
-  writeFileSync(join(cwd, 'CHANGELOG.md'), `# Changelog\n\n${original}\n## [1.2.0] - 2026-08-01\n\n- Previous release.\n`)
-  if (productCut) writeFileSync(join(cwd, 'product.js'), 'unreviewed code\n')
-  git(cwd, ['add', '.'])
-  git(cwd, ['commit', '-m', 'chore(release): 1.3.0'])
-  const cutSha = git(cwd, ['rev-parse', 'HEAD']).trim()
-  git(cwd, ['switch', 'main'])
-  git(cwd, ['merge', '--no-ff', 'old-metadata', '-m', 'Merge reviewed metadata'])
-  const mergeSha = git(cwd, ['rev-parse', 'HEAD']).trim()
-  git(cwd, ['tag', '-a', 'v1.3.0-rc.1', '-m', 'Failed candidate'])
-  git(cwd, ['push', 'origin', 'main', '--tags'])
-  const reviewed = '## [1.3.0] - 2026-08-24\n\n### Added\n- Reviewed corrected notes.\n\n### Fixed\n- Candidate failure.\n'
-  writeFileSync(join(cwd, 'CHANGELOG.md'), `# Changelog\n\n${reviewed}\n## [1.2.0] - 2026-08-01\n\n- Previous release.\n`)
-  writeFileSync(join(cwd, 'product.js'), 'reviewed fix\n')
-  git(cwd, ['add', '.'])
-  git(cwd, ['commit', '-m', 'fix: candidate failure and release notes'])
-  const sha = git(cwd, ['rev-parse', 'HEAD']).trim()
-  git(cwd, ['push', 'origin', 'main'])
-  const preparedMetadata = {
-    schema: 'prepared-release-metadata/v1', repository: 'example/demo', version: '1.3.0', metadataPr: 42,
-    cutSha, mergeSha,
-    previousAttempt: { receiptId: 'failed-attempt-1', receiptSha256: 'a'.repeat(64), candidateTag: 'v1.3.0-rc.1', candidateSha: mergeSha },
-  }
-  return { cwd, remote, sha, preparedMetadata, original, reviewed }
-}
-
-function preparedPlan(fixture, opts = {}) {
-  return planRelease({ ...fixture, cloudRun: true, now: new Date('2026-08-25T00:00:00Z'), ...opts })
-}
-
-const digest = (text) => createHash('sha256').update(text).digest('hex')
-
-test('prepared reuse preserves version and binds reviewed target notes separately from historical metadata', (t) => {
-  const f = preparedRepo(t)
-  const oldReceipt = join(f.cwd, '.git', 'resolve-release-authorization.json')
-  writeFileSync(oldReceipt, 'historical receipt: must not be read or changed')
-  const before = git(f.cwd, ['status', '--porcelain'])
-  const plan = preparedPlan(f)
-  assert.equal(plan.nextVersion, '1.3.0')
-  assert.equal(plan.currentVersion, '1.3.0')
-  assert.equal(plan.bump, 'none')
-  assert.equal(plan.tag, 'v1.3.0')
-  assert.equal(plan.candidateTag, 'v1.3.0-rc.2')
-  assert.equal(plan.sha, f.sha)
-  assert.equal(plan.releaseSourceSha, f.sha)
-  assert.equal(plan.changelogMarkdown, f.reviewed)
-  assert.equal(plan.date, '2026-08-24')
-  assert.equal(plan.metadata.mode, 'reuse-prepared')
-  assert.equal(plan.metadata.cutSha, f.preparedMetadata.cutSha)
-  assert.equal(plan.metadata.mergeSha, f.preparedMetadata.mergeSha)
-  assert.equal(plan.metadata.preparedSectionSha256, digest(f.reviewed))
-  assert.equal(plan.metadata.originalSectionSha256, digest(f.original))
-  assert.deepEqual(plan.metadata.previousAttempt, f.preparedMetadata.previousAttempt)
-  assert.notEqual(plan.receiptId, f.preparedMetadata.previousAttempt.receiptId)
-  assert.notEqual(preparedPlan(f).receiptId, plan.receiptId)
-  assert.equal('permissions' in plan, false)
-  assert.equal(readFileSync(oldReceipt, 'utf8'), 'historical receipt: must not be read or changed')
-  assert.equal(git(f.cwd, ['status', '--porcelain']), before)
-  // Neither a dirty worktree nor a later commit can replace the frozen source or notes.
-  writeFileSync(join(f.cwd, 'VERSION'), '9.0.0\n')
-  git(f.cwd, ['add', 'VERSION'])
-  git(f.cwd, ['commit', '-m', 'feat!: unrelated later change'])
-  assert.equal(preparedPlan(f).metadata.preparedSectionSha256, digest(f.reviewed))
-})
-
-test('prepared reuse uses remote ordinals even with stale local tags and never recycles the historical ordinal', (t) => {
-  const f = preparedRepo(t)
-  git(f.cwd, ['tag', 'v1.3.0-rc.4'])
-  git(f.cwd, ['push', 'origin', 'refs/tags/v1.3.0-rc.4'])
-  git(f.cwd, ['tag', '-d', 'v1.3.0-rc.4', 'v1.3.0-rc.1'])
-  assert.equal(preparedPlan(f).candidateTag, 'v1.3.0-rc.5')
-  git(f.remote, ['update-ref', '-d', 'refs/tags/v1.3.0-rc.4'])
-  git(f.remote, ['update-ref', '-d', 'refs/tags/v1.3.0-rc.1'])
-  assert.equal(preparedPlan(f).candidateTag, 'v1.3.0-rc.2')
-})
-
-test('prepared reuse blocks a remote final tag, inspection errors and noncanonical or wrong repository identity', (t) => {
-  const f = preparedRepo(t)
-  git(f.cwd, ['tag', '-a', 'v1.3.0', '-m', 'Already used'])
-  git(f.cwd, ['push', 'origin', 'refs/tags/v1.3.0'])
-  git(f.cwd, ['tag', '-d', 'v1.3.0'])
-  assert.throws(() => preparedPlan(f), /final tag.*already exists/)
-  git(f.remote, ['update-ref', '-d', 'refs/tags/v1.3.0'])
-  git(f.cwd, ['config', '--unset', `url.${f.remote}.insteadOf`])
-  // Repoint only the transport rewrite; origin's canonical identity stays valid.
-  git(f.cwd, ['config', `url.${join(f.remote, 'missing')}.insteadOf`, 'https://github.com/example/demo.git'])
-  assert.throws(() => preparedPlan(f), /remote inspection failed/)
-  git(f.cwd, ['remote', 'set-url', 'origin', f.remote])
-  assert.throws(() => preparedPlan(f), /canonical GitHub origin/)
-  git(f.cwd, ['remote', 'set-url', 'origin', 'https://github.com/other/demo.git'])
-  assert.throws(() => preparedPlan(f), /repository.*does not match/)
-})
-
-test('prepared reuse refuses product changes hidden in the original metadata cut', (t) => {
-  for (const options of [{ productCut: true }, { badLockCut: true }, { badPackageCut: true }]) {
-    const f = preparedRepo(t, options)
-    assert.throws(() => preparedPlan(f), /metadata-only/)
-  }
-})
-
-test('prepared reuse validates schema, full identities, previous attempt binding and unchanged version identity', (t) => {
-  const f = preparedRepo(t)
-  const p = f.preparedMetadata
-  const cases = [
-    [{ ...p, schema: 'future/v2' }, /schema/],
-    [{ ...p, version: 'v1.3.0' }, /version/],
-    [{ ...p, version: '1.4.0', previousAttempt: { ...p.previousAttempt, candidateTag: 'v1.4.0-rc.1' } }, /version.*does not match/],
-    [{ ...p, metadataPr: 0 }, /metadataPr/],
-    [{ ...p, mergeSha: 'HEAD' }, /full.*SHA/],
-    [{ ...p, cutSha: p.cutSha.slice(0, 12) }, /full.*SHA/],
-    [{ ...p, extraPermission: true }, /unknown field/],
-    [{ ...p, previousAttempt: { ...p.previousAttempt, receiptSha256: '' } }, /receiptSha256/],
-    [{ ...p, previousAttempt: { ...p.previousAttempt, candidateSha: f.sha } }, /previous.*candidateSha/],
-    [{ ...p, previousAttempt: { ...p.previousAttempt, candidateTag: 'v1.4.0-rc.1' } }, /previous.*candidateTag/],
-  ]
-  for (const [preparedMetadata, error] of cases) assert.throws(() => preparedPlan(f, { preparedMetadata }), error)
-  assert.throws(() => preparedPlan(f, { sha: 'HEAD' }), /full.*SHA/)
-  assert.throws(() => preparedPlan(f, { trunk: 'release' }), /trunk.*main/)
-  assert.throws(() => preparedPlan(f, { darkFlags: [{ name: 'flag', summary: 'Unreviewed notes' }] }), /dark flags/)
-})
-
-test('prepared reuse rejects unequal merge trees, unrelated provenance and missing commit objects', (t) => {
-  const f = preparedRepo(t)
-  const p = f.preparedMetadata
-  const unequal = { ...p, mergeSha: f.sha, previousAttempt: { ...p.previousAttempt, candidateSha: f.sha } }
-  assert.throws(() => preparedPlan(f, { preparedMetadata: unequal }), /cut and merge trees/)
-  git(f.cwd, ['switch', '--orphan', 'unrelated'])
-  git(f.cwd, ['add', '.'])
-  git(f.cwd, ['commit', '--allow-empty', '-m', 'unrelated root'])
-  const unrelated = git(f.cwd, ['rev-parse', 'HEAD']).trim()
-  assert.throws(() => preparedPlan(f, { sha: unrelated }), /merge.*ancestor/)
-  assert.throws(() => preparedPlan(f, { sha: 'f'.repeat(40) }), /failed|object|revision/i)
-})
-
-test('prepared reuse rejects target identity drift, duplicate or absent release notes and a rebound old RC', (t) => {
-  const f = preparedRepo(t)
-  const checkChange = (file, text, error) => {
-    git(f.cwd, ['reset', '--hard', f.sha])
-    writeFileSync(join(f.cwd, file), text)
-    git(f.cwd, ['add', file])
-    git(f.cwd, ['commit', '-m', 'fix: invalid prepared identity'])
-    const sha = git(f.cwd, ['rev-parse', 'HEAD']).trim()
-    assert.throws(() => preparedPlan(f, { sha }), error)
-  }
-  checkChange('VERSION', '1.4.0\n', /version.*does not match/)
-  checkChange('package-lock.json', JSON.stringify({ name: 'demo', version: '1.3.0', packages: { '': { version: '1.2.0' } } }), /root lock.*version/)
-  checkChange('package-lock.json', JSON.stringify({ name: 'foreign', version: '1.3.0', packages: { '': { version: '1.3.0' } } }), /root lock.*name/)
-  checkChange('CHANGELOG.md', `${f.reviewed}\n${f.reviewed}`, /exactly one/)
-  checkChange('CHANGELOG.md', '# Changelog\n', /exactly one/)
-  git(f.remote, ['update-ref', 'refs/tags/v1.3.0-rc.1', f.sha])
-  assert.throws(() => preparedPlan(f), /previous.*remote.*SHA/)
-})
-
-test('prepared reuse validates Python project identity without confusing tool versions, and supports artifact-only plans', (t) => {
-  const f = preparedRepo(t, { python: true })
-  const plan = preparedPlan(f, { cloudRun: false })
-  assert.equal(plan.candidateTag, null)
-  assert.equal(plan.bump, 'none')
-  assert.deepEqual(plan.versionFiles, ['package.json', 'package-lock.json', 'pyproject.toml', 'VERSION'])
-  writeFileSync(join(f.cwd, 'pyproject.toml'), '[project]\nversion = "1.4.0"\n')
-  git(f.cwd, ['add', '.'])
-  git(f.cwd, ['commit', '-m', 'fix: mismatched python identity'])
-  assert.throws(() => preparedPlan(f, { sha: git(f.cwd, ['rev-parse', 'HEAD']).trim() }), /pyproject.toml version.*does not match/)
-})
-
-test('prepared reuse refuses distribution cuts instead of trusting a broad generated-file allowlist', (t) => {
-  const f = preparedRepo(t)
-  mkdirSync(join(f.cwd, 'skills/distribution'), { recursive: true })
-  writeFileSync(join(f.cwd, 'skills/distribution/manifest.json'), JSON.stringify({ releaseVersion: '1.3.0' }))
-  git(f.cwd, ['add', '.'])
-  git(f.cwd, ['commit', '-m', 'chore: distribution identity'])
-  const cutSha = git(f.cwd, ['rev-parse', 'HEAD']).trim()
-  const preparedMetadata = { ...f.preparedMetadata, cutSha, mergeSha: cutSha,
-    previousAttempt: { ...f.preparedMetadata.previousAttempt, candidateSha: cutSha } }
-  assert.throws(() => preparedPlan(f, { sha: cutSha, preparedMetadata }), /distribution-aware.*unsupported/)
-})
-
-test('prepared reuse blocks an RC collision introduced between remote discovery and the exact absence check', (t) => {
-  const f = preparedRepo(t)
-  const uploadPack = join(f.cwd, '.git', 'upload-pack.sh')
-  writeFileSync(uploadPack, `#!/bin/sh\ngit-upload-pack "$@"\nstatus=$?\ngit --git-dir='${f.remote}' update-ref refs/tags/v1.3.0-rc.2 ${f.sha}\nexit "$status"\n`, { mode: 0o755 })
-  git(f.cwd, ['config', 'remote.origin.uploadpack', uploadPack])
-  assert.throws(() => preparedPlan(f), /proposed candidate tag already exists remotely/)
-})
-
-test('prepared reuse blocks an exact remote inspection failure after successful discovery', (t) => {
-  const f = preparedRepo(t)
-  const uploadPack = join(f.cwd, '.git', 'upload-pack.sh')
-  const marker = join(f.cwd, '.git', 'inspected')
-  writeFileSync(uploadPack, `#!/bin/sh\nif test -e '${marker}'; then exit 1; fi\ntouch '${marker}'\nexec git-upload-pack "$@"\n`, { mode: 0o755 })
-  git(f.cwd, ['config', 'remote.origin.uploadpack', uploadPack])
-  assert.throws(() => preparedPlan(f), /remote inspection failed/)
-})
-
-test('CLI loads prepared metadata without applying it and rejects missing, malformed and unknown options', (t) => {
-  const f = preparedRepo(t)
-  const file = join(f.cwd, '.git', 'prepared.json')
-  writeFileSync(file, JSON.stringify(f.preparedMetadata))
-  const script = join(import.meta.dirname, 'plan.mjs')
-  const run = (...args) => spawnSync(process.execPath, [script, '--sha', f.sha, '--json', ...args], { cwd: f.cwd, encoding: 'utf8' })
-  const result = run('--prepared-metadata', file, '--cloud-run')
-  assert.equal(result.status, 0, result.stderr)
-  assert.equal(JSON.parse(result.stdout).sha, f.sha)
-  assert.equal(JSON.parse(result.stdout).bump, 'none')
-  assert.equal(JSON.parse(result.stdout).metadata.preparedSectionSha256, digest(f.reviewed))
-  assert.equal(run('--prepared-metadata').status, 2)
-  writeFileSync(file, '{')
-  assert.notEqual(run('--prepared-metadata', file).status, 0)
-  assert.equal(run('--version', '9.0.0').status, 2)
-})