@askexenow/exe-os 0.9.384 → 0.9.389

package/dist/stack-release-5PGWV5D4.js

@@ -1,1607 +0,0 @@
-#!/usr/bin/env node
-import {
-  writeSignedStackManifest
-} from "./chunk-MOANZQXF.js";
-import "./chunk-ZBPZDADW.js";
-import "./chunk-EC5H53YD.js";
-import {
-  assertPreflightGate,
-  runPreflightOnManifest
-} from "./chunk-PLII76NJ.js";
-import "./chunk-C5HUMAA7.js";
-import "./chunk-L25OAFOU.js";
-import "./chunk-LFUBEHFW.js";
-import "./chunk-TNS63ATU.js";
-import "./chunk-A7XLR3K7.js";
-import "./chunk-DZN7SDY2.js";
-import "./chunk-MMS2HBRT.js";
-import "./chunk-RH4AH3YB.js";
-import "./chunk-HSGBZSCA.js";
-import "./chunk-JKKZGDLP.js";
-import "./chunk-MLKGABMK.js";
-
-// src/bin/stack-release.ts
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2 } from "fs";
-import { execFile as execFileCb } from "child_process";
-import { promisify } from "util";
-import path2 from "path";
-import { createInterface } from "readline";
-
-// src/lib/release-lock.ts
-import {
-  closeSync,
-  existsSync,
-  mkdirSync,
-  openSync,
-  readFileSync,
-  unlinkSync,
-  writeFileSync
-} from "fs";
-import { homedir, hostname as osHostname } from "os";
-import path from "path";
-import process2 from "process";
-var DEFAULT_RELEASE_LOCK_TTL_MS = 2 * 60 * 60 * 1e3;
-function defaultReleaseLockPath() {
-  return path.join(homedir(), ".exe-os", "release.lock");
-}
-function defaultIsPidAlive(pid) {
-  if (!Number.isInteger(pid) || pid <= 0) return false;
-  try {
-    process2.kill(pid, 0);
-    return true;
-  } catch (err) {
-    const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
-    return code === "EPERM";
-  }
-}
-function readLock(lockPath) {
-  const raw = readFileSync(lockPath, "utf8");
-  const parsed = JSON.parse(raw);
-  if (typeof parsed.pid !== "number" || typeof parsed.startedAt !== "string" || typeof parsed.targetVersion !== "string" || typeof parsed.branch !== "string" || typeof parsed.hostname !== "string") {
-    throw new Error("lock file is missing required fields");
-  }
-  return parsed;
-}
-function writeLockAtomic(lockPath, lock) {
-  mkdirSync(path.dirname(lockPath), { recursive: true });
-  const fd = openSync(lockPath, "wx", 384);
-  try {
-    writeFileSync(fd, JSON.stringify(lock, null, 2) + "\n", "utf8");
-  } finally {
-    closeSync(fd);
-  }
-}
-function sameLock(a, b) {
-  return a.pid === b.pid && a.startedAt === b.startedAt && a.targetVersion === b.targetVersion && a.branch === b.branch && a.hostname === b.hostname;
-}
-function acquireReleaseLock(opts) {
-  const lockPath = opts.lockPath ?? defaultReleaseLockPath();
-  const ttlMs = opts.ttlMs ?? DEFAULT_RELEASE_LOCK_TTL_MS;
-  const now = opts.now ?? /* @__PURE__ */ new Date();
-  const isPidAlive = opts.isPidAlive ?? defaultIsPidAlive;
-  const logNote = opts.log ?? (() => {
-  });
-  if (existsSync(lockPath)) {
-    let existing = null;
-    try {
-      existing = readLock(lockPath);
-    } catch (err) {
-      const detail = err instanceof Error ? err.message : String(err);
-      if (!opts.force) {
-        throw new Error(
-          `release lock exists but cannot be read safely (${detail}); re-run with --force to override: ${lockPath}`
-        );
-      }
-      unlinkSync(lockPath);
-      logNote(`release lock force-cleared unreadable lock at ${lockPath}`);
-    }
-    if (existing) {
-      const startedMs = Date.parse(existing.startedAt);
-      if (!Number.isFinite(startedMs) && !opts.force) {
-        throw new Error(
-          `release lock exists with an invalid timestamp (${existing.startedAt}); re-run with --force to override: ${lockPath}`
-        );
-      }
-      const ageMs = Number.isFinite(startedMs) ? now.getTime() - startedMs : Number.POSITIVE_INFINITY;
-      const pidAlive = isPidAlive(existing.pid);
-      const fresh = ageMs < ttlMs && pidAlive;
-      if (fresh && !opts.force) {
-        throw new Error(
-          `release already in progress: pid ${existing.pid} started ${existing.startedAt}; re-run with --force to override`
-        );
-      }
-      unlinkSync(lockPath);
-      if (fresh) {
-        logNote(`release lock force-cleared: pid ${existing.pid} started ${existing.startedAt}`);
-      } else {
-        const reason = !pidAlive ? "pid is not alive" : `older than ${Math.round(ttlMs / 6e4)}m TTL`;
-        logNote(`stale release lock cleared: pid ${existing.pid} started ${existing.startedAt} (${reason})`);
-      }
-    }
-  }
-  const lock = {
-    pid: opts.pid ?? process2.pid,
-    startedAt: now.toISOString(),
-    targetVersion: opts.targetVersion,
-    branch: opts.branch,
-    hostname: opts.hostname ?? osHostname()
-  };
-  try {
-    writeLockAtomic(lockPath, lock);
-  } catch (err) {
-    const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
-    if (code === "EEXIST") {
-      throw new Error(`release lock was acquired by another process; re-run when it completes: ${lockPath}`);
-    }
-    throw err;
-  }
-  return {
-    lockPath,
-    lock,
-    release: () => {
-      if (!existsSync(lockPath)) return;
-      try {
-        const current = readLock(lockPath);
-        if (sameLock(current, lock)) unlinkSync(lockPath);
-      } catch {
-      }
-    }
-  };
-}
-
-// scripts/lib/stack-release-repos.mjs
-var STACK_RELEASE_REPO_CONFIGS = Object.freeze([
-  {
-    serviceKey: "exe-os",
-    ghRepo: "AskExe/exe-os",
-    localDir: ".",
-    imageName: "update.askexe.com/askexe/exe-os",
-    releaseWorkflow: "release-stack-image.yml",
-    simpleTag: true,
-    defaultBranch: "main"
-  },
-  {
-    serviceKey: "gateway",
-    ghRepo: "AskExe/exe-gateway",
-    localDir: "exe-gateway",
-    imageName: "update.askexe.com/askexe/exe-gateway",
-    releaseWorkflow: "release-image.yml",
-    simpleTag: true,
-    defaultBranch: "main"
-  },
-  {
-    serviceKey: "crm",
-    ghRepo: "AskExe/exe-crm",
-    localDir: "exe-crm",
-    imageName: "update.askexe.com/askexe/exe-crm",
-    releaseWorkflow: "release-stack-image.yml",
-    simpleTag: true,
-    defaultBranch: "main"
-  },
-  {
-    serviceKey: "erp",
-    ghRepo: "AskExe/exe-erp",
-    localDir: "exe-erp",
-    imageName: "update.askexe.com/askexe/exe-erp",
-    releaseWorkflow: "release-stack-image.yml",
-    simpleTag: true,
-    defaultBranch: "main"
-  },
-  {
-    serviceKey: "wiki",
-    ghRepo: "AskExe/exe-wiki",
-    localDir: "exe-wiki",
-    imageName: "update.askexe.com/askexe/exe-wiki",
-    releaseWorkflow: "release-stack-image.yml",
-    simpleTag: true,
-    defaultBranch: "master"
-  },
-  {
-    serviceKey: "monitor-hub",
-    ghRepo: "AskExe/exe-monitor",
-    localDir: "exe-monitor",
-    imageName: "update.askexe.com/askexe/exe-monitor-hub",
-    releaseWorkflow: "release-stack-image.yml",
-    simpleTag: true,
-    defaultBranch: "main"
-  },
-  {
-    serviceKey: "monitor-agent",
-    ghRepo: "AskExe/exe-monitor",
-    localDir: "exe-monitor",
-    imageName: "update.askexe.com/askexe/exe-monitor-agent",
-    releaseWorkflow: "release-stack-image.yml",
-    simpleTag: true,
-    defaultBranch: "main"
-  },
-  {
-    serviceKey: "exe-build",
-    ghRepo: "AskExe/exe-build",
-    localDir: "exe-build",
-    imageName: "update.askexe.com/askexe/exe-build",
-    releaseWorkflow: "release-stack-image.yml",
-    simpleTag: true,
-    defaultBranch: "main"
-  }
-]);
-var STACK_RECONCILE_APP_IMAGE_REPOS = Object.freeze([
-  // exe-auth is shipped in stack manifests but is not released by
-  // `stack-release`, so it must be covered by G6's exact-repo reconciliation map.
-  {
-    imageName: "update.askexe.com/askexe/exe-auth",
-    ghRepo: "AskExe/exe-auth"
-  },
-  // exe-dashboard: same gap — it was absent from both maps in this file, so
-  // G6's reconcile classified an unstamped dashboard image as "no expected
-  // source repo mapped here" (third-party, informational), exactly the false
-  // pass the "unstamped-third-party" distinction exists to avoid for images
-  // this repo family DOES build.
-  //
-  // 🔴 THE REPO HERE IS THE REPO THE IMAGE IS BUILT IN, NOT THE ONE THAT WILL
-  // EVENTUALLY OWN IT. G6 compares this value against the image's org.exe.repo
-  // label, which the shared release lane stamps with the repository the build
-  // actually ran in. exe-dashboard is still built from `dashboard-page/` INSIDE
-  // AskExe/exe-os (.github/workflows/release-dashboard-image.yml passes
-  // `context: dashboard-page`); AskExe/exe-dashboard exists but its history
-  // extraction is unfinished and nothing is built there yet. The real published
-  // ghcr.io/askexe/exe-dashboard:v0.9.382 carries org.exe.repo=AskExe/exe-os
-  // (recorded verbatim in release-service.yml's G2 arming note), so naming the
-  // destination repo here turns every correctly-stamped dashboard release into
-  // a "wrong-repo image (bug 218b10e4 class)" failure — and simultaneously
-  // makes that signal useless for the one service it would be reporting on.
-  //
-  // release-contract-services.mjs's `ghRepo: "AskExe/exe-dashboard"` is a
-  // different field with a different meaning: it names the repo that OWNS the
-  // service in the migration table. Copying it into this provenance map is how
-  // the wrong value got here.
-  //
-  // When the extraction completes, the lane's `context` flips to `.` and moves
-  // to AskExe/exe-dashboard; flip this with it. A test in
-  // tests/scripts/image-provenance.test.ts reads that `context` and fails if
-  // the two disagree, so this cannot drift silently a second time.
-  {
-    imageName: "update.askexe.com/askexe/exe-dashboard",
-    ghRepo: "AskExe/exe-os"
-  }
-]);
-
-// src/bin/stack-release.ts
-var execFile = promisify(execFileCb);
-function findExeOsRoot() {
-  const envRoot = process.env.EXE_OS_ROOT;
-  if (envRoot && existsSync2(envRoot)) return path2.resolve(envRoot);
-  let dir = path2.dirname(new URL(import.meta.url).pathname);
-  for (let i = 0; i < 5; i++) {
-    const pkgPath = path2.join(dir, "package.json");
-    if (existsSync2(pkgPath)) {
-      try {
-        const pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
-        if (pkg.name === "@askexenow/exe-os") return dir;
-      } catch {
-      }
-    }
-    dir = path2.dirname(dir);
-  }
-  return path2.resolve(path2.dirname(new URL(import.meta.url).pathname), "..", "..");
-}
-var EXE_OS_ROOT = findExeOsRoot();
-var PARENT_DIR = path2.dirname(EXE_OS_ROOT);
-var MANIFEST_PATH = path2.join(EXE_OS_ROOT, "deploy", "stack-manifests", "v0.9.json");
-function applyRootOverride(rootPath) {
-  const resolved = path2.resolve(rootPath);
-  if (!existsSync2(resolved)) {
-    throw new Error(`--root path does not exist: ${resolved}`);
-  }
-  EXE_OS_ROOT = resolved;
-  PARENT_DIR = path2.dirname(EXE_OS_ROOT);
-  MANIFEST_PATH = path2.join(EXE_OS_ROOT, "deploy", "stack-manifests", "v0.9.json");
-}
-function resolveRepoPath(dirName) {
-  const direct = path2.join(PARENT_DIR, dirName);
-  if (existsSync2(direct)) return direct;
-  const aliases = {
-    "exe-crm": ["openclaw", "exe-crm"],
-    "exe-wiki": ["ink", "exe-wiki"]
-  };
-  const candidates = aliases[dirName];
-  if (candidates) {
-    for (const alias of candidates) {
-      const p = path2.join(PARENT_DIR, alias);
-      if (existsSync2(p)) return p;
-    }
-  }
-  return direct;
-}
-function buildRepoConfigs() {
-  return STACK_RELEASE_REPO_CONFIGS.map(({ localDir, ...repo }) => ({
-    ...repo,
-    localPath: localDir === "." ? EXE_OS_ROOT : resolveRepoPath(localDir)
-  }));
-}
-function parseReleaseArgs(argv) {
-  const flags = {
-    stack: false,
-    dryRun: false,
-    yes: false,
-    repos: null,
-    major: false,
-    minor: false,
-    skipImageVerify: false,
-    allowRed: false,
-    root: null,
-    forceBuildRejected: false,
-    canary: false,
-    allowDirty: false,
-    force: false
-  };
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg === "--stack") flags.stack = true;
-    else if (arg === "--dry-run") flags.dryRun = true;
-    else if (arg === "--yes" || arg === "-y") flags.yes = true;
-    else if (arg === "--major") flags.major = true;
-    else if (arg === "--minor") flags.minor = true;
-    else if (arg === "--skip-image-verify") flags.skipImageVerify = true;
-    else if (arg === "--allow-red") flags.allowRed = true;
-    else if (arg === "--allow-dirty") flags.allowDirty = true;
-    else if (arg === "--canary") flags.canary = true;
-    else if (arg === "--force") flags.force = true;
-    else if (arg === "--repos" && argv[i + 1]) {
-      flags.repos = argv[++i].split(",").map((s) => s.trim()).filter(Boolean);
-    } else if (arg.startsWith("--repos=")) {
-      flags.repos = arg.slice("--repos=".length).split(",").map((s) => s.trim()).filter(Boolean);
-    } else if (arg === "--root" && argv[i + 1]) {
-      flags.root = argv[++i];
-    } else if (arg.startsWith("--root=")) {
-      flags.root = arg.slice("--root=".length);
-    } else if (arg === "--force-build") {
-      flags.forceBuildRejected = true;
-    }
-  }
-  return flags;
-}
-async function git(repoPath, ...args) {
-  const { stdout } = await execFile("git", ["-C", repoPath, ...args], {
-    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
-  });
-  return stdout.trim();
-}
-async function assertCleanWorkingTree(opts) {
-  const gitStatus = opts.gitStatus ?? (() => git(EXE_OS_ROOT, "status", "--porcelain"));
-  const status = (await gitStatus()).trim();
-  if (!status) return;
-  const dirtyPaths = status.split("\n").map((l) => l.trim()).filter(Boolean);
-  if (opts.allowDirty) {
-    console.warn("\n  \x1B[33;1m\u26A0  --allow-dirty: releasing with a DIRTY working tree\x1B[0m");
-    console.warn("  \x1B[33m   Uncommitted changes are present in exe-os and may leak into the release:\x1B[0m");
-    for (const p of dirtyPaths) console.warn(`  \x1B[33m     ${p}\x1B[0m`);
-    console.warn("  \x1B[33m   Use only for break-glass emergencies.\x1B[0m\n");
-    return;
-  }
-  throw new Error(
-    `Refusing to release: the exe-os working tree is not clean (${dirtyPaths.length} dirty path(s)).
-` + dirtyPaths.map((p) => `    ${p}`).join("\n") + `
-Commit, stash, or discard these changes first \u2014 or pass --allow-dirty to override (break-glass).`
-  );
-}
-async function getLastTag(repoPath) {
-  try {
-    return await git(repoPath, "describe", "--tags", "--abbrev=0");
-  } catch {
-    return null;
-  }
-}
-async function getCommitsSinceTag(repoPath, tag) {
-  try {
-    const output = await git(repoPath, "log", `${tag}..HEAD`, "--oneline");
-    return output.split("\n").filter(Boolean);
-  } catch {
-    return [];
-  }
-}
-async function ghRun(args) {
-  const { stdout } = await execFile("gh", args);
-  return stdout.trim();
-}
-function isStrictSemverTag(tag) {
-  return /^v\d+\.\d+\.\d+$/.test(tag);
-}
-function compareSemver(a, b) {
-  const pa = a.split(".").map(Number);
-  const pb = b.split(".").map(Number);
-  for (let i = 0; i < 3; i++) {
-    const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
-    if (diff !== 0) return diff;
-  }
-  return 0;
-}
-function higherSemver(a, b) {
-  return compareSemver(a, b) >= 0 ? a : b;
-}
-function parseRemoteTagNames(lsRemoteOutput) {
-  return lsRemoteOutput.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => line.split("	")[1] ?? "").filter((ref) => ref.startsWith("refs/tags/")).map((ref) => ref.slice("refs/tags/".length).replace(/\^\{\}$/, ""));
-}
-function highestReleasedVersion(tagNames) {
-  let best = null;
-  for (const tag of tagNames) {
-    if (!isStrictSemverTag(tag)) continue;
-    const version = tag.slice(1);
-    best = best === null ? version : higherSemver(best, version);
-  }
-  return best;
-}
-async function getRemoteReleaseTags(repoPath, gitRunner = git) {
-  try {
-    const out = await gitRunner(repoPath, "ls-remote", "--tags", "origin");
-    return parseRemoteTagNames(out);
-  } catch {
-    return [];
-  }
-}
-async function resolveVersionBasis(repoPath, packageVersion, gitRunner = git) {
-  const highestTag = highestReleasedVersion(await getRemoteReleaseTags(repoPath, gitRunner));
-  return highestTag ? higherSemver(packageVersion, highestTag) : packageVersion;
-}
-async function assertVersionNotAlreadyReleased(repoPath, tag, gitRunner = git) {
-  const out = await gitRunner(repoPath, "ls-remote", "--tags", "origin", `refs/tags/${tag}`);
-  if (out.trim().length > 0) {
-    throw new Error(
-      `refusing to cut ${tag}: this tag already exists on origin. package.json (and/or the computed bump basis) has drifted behind real release history \u2014 resync before releasing. (bug 343af002)`
-    );
-  }
-}
-async function assertReleaseFreshness(opts) {
-  const runGit = opts.gitRunner ?? git;
-  const logFn = opts.log ?? log;
-  const originRef = `origin/${opts.defaultBranch}`;
-  logFn("info", `Freshness gate: fetching origin ${opts.defaultBranch} before publish...`);
-  await runGit(opts.repoPath, "fetch", "origin", opts.defaultBranch);
-  const missing = (await runGit(opts.repoPath, "log", `${opts.releaseCommit}..${originRef}`, "--oneline")).trim();
-  if (missing) {
-    throw new Error(
-      `Freshness gate failed: ${originRef} contains commits not included in release commit ${opts.releaseCommit}.
-Missing-PR list:
-${missing}
-Abort: rebase/re-cut the release from current ${originRef} before publishing.`
-    );
-  }
-  try {
-    await runGit(opts.repoPath, "merge-base", "--is-ancestor", originRef, opts.releaseCommit);
-  } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err);
-    throw new Error(
-      `Freshness gate failed: release commit ${opts.releaseCommit} is not a descendant of ${originRef}. Abort: rebase/re-cut the release from current ${originRef} before publishing. (${detail})`
-    );
-  }
-  logFn("ok", `Freshness gate passed: release commit contains current ${originRef}`);
-}
-async function printOpenPrGate(opts) {
-  const baseBranch = opts.baseBranch ?? "main";
-  const runGh = opts.ghRunner ?? ghRun;
-  const logFn = opts.log ?? log;
-  try {
-    const output = await runGh([
-      "pr",
-      "list",
-      "--repo",
-      opts.ghRepo,
-      "--base",
-      baseBranch,
-      "--json",
-      "number,title"
-    ]);
-    const prs = JSON.parse(output);
-    if (prs.length === 0) {
-      logFn("info", `Open PR gate: no open PRs targeting ${baseBranch} in ${opts.ghRepo}`);
-      return;
-    }
-    logFn("warn", `Open PR gate: ${prs.length} open PR(s) targeting ${baseBranch} in ${opts.ghRepo}:`);
-    for (const pr of prs) {
-      const number = typeof pr.number === "number" ? `#${pr.number}` : "#?";
-      logFn("warn", `  ${number} ${pr.title ?? "(untitled)"}`);
-    }
-  } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err);
-    logFn("warn", `Open PR gate: unable to list open PRs for ${opts.ghRepo} targeting ${baseBranch}; continuing (${detail})`);
-  }
-}
-function bumpVersion(version, mode) {
-  const parts = version.split(".").map(Number);
-  if (parts.length < 3) throw new Error(`Invalid version: ${version}`);
-  const [major, minor, patch] = parts;
-  switch (mode) {
-    case "major":
-      return `${major + 1}.0.0`;
-    case "minor":
-      return `${major}.${minor + 1}.0`;
-    case "patch":
-    default:
-      return `${major}.${minor}.${patch + 1}`;
-  }
-}
-function readPackageVersion(repoPath) {
-  const pkgPath = path2.join(repoPath, "package.json");
-  if (!existsSync2(pkgPath)) {
-    throw new Error(`Missing package.json at ${pkgPath}`);
-  }
-  const pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
-  return pkg.version;
-}
-function readPackageVersionOrNull(repoPath) {
-  const pkgPath = path2.join(repoPath, "package.json");
-  if (!existsSync2(pkgPath)) return null;
-  return readPackageVersion(repoPath);
-}
-function repoName(repo) {
-  return repo.ghRepo.split("/").pop() ?? repo.serviceKey;
-}
-function warnMissingRepoPackage(repo) {
-  log(
-    "warn",
-    `repo not cloned: clone ${repo.ghRepo} or pass --repos to skip ${repoName(repo)} (${repo.localPath}/package.json missing)`
-  );
-}
-function hasPackageJson(repo) {
-  return existsSync2(path2.join(repo.localPath, "package.json"));
-}
-function deriveCloneUrl(repo) {
-  return `https://github.com/${repo.ghRepo}.git`;
-}
-function isCloneTargetSafe(targetPath, parentDir) {
-  const resolvedParent = path2.resolve(parentDir);
-  const resolvedTarget = path2.resolve(targetPath);
-  return resolvedTarget === resolvedParent || resolvedTarget.startsWith(resolvedParent + path2.sep);
-}
-var defaultCloneRunner = async (url, targetPath) => {
-  await execFile("git", ["clone", url, targetPath], {
-    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
-  });
-};
-async function ensureRepoCloned(repo, parentDir = PARENT_DIR, runClone = defaultCloneRunner) {
-  if (hasPackageJson(repo)) return false;
-  const target = repo.localPath;
-  if (!isCloneTargetSafe(target, parentDir)) {
-    throw new Error(
-      `refusing to auto-clone ${repo.ghRepo}: target ${target} is outside resolved root ${parentDir}`
-    );
-  }
-  const url = deriveCloneUrl(repo);
-  log("info", `repo not cloned: auto-cloning ${repo.ghRepo} \u2192 ${target}`);
-  try {
-    await runClone(url, target);
-  } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err);
-    throw new Error(`git clone failed for ${repo.ghRepo} (${url} \u2192 ${target}): ${detail}`);
-  }
-  log("ok", `cloned ${repo.ghRepo} \u2192 ${target}`);
-  return true;
-}
-function readStackReleaseJson(repoPath) {
-  const p = path2.join(repoPath, "stack.release.json");
-  if (!existsSync2(p)) return null;
-  return JSON.parse(readFileSync2(p, "utf8"));
-}
-async function detectChanges(repos) {
-  const changes = [];
-  for (const repo of repos) {
-    let currentVersion = readPackageVersionOrNull(repo.localPath);
-    if (!currentVersion) {
-      await ensureRepoCloned(repo);
-      currentVersion = readPackageVersionOrNull(repo.localPath);
-      if (!currentVersion) {
-        warnMissingRepoPackage(repo);
-        continue;
-      }
-    }
-    const basisVersion = await resolveVersionBasis(repo.localPath, currentVersion);
-    if (basisVersion !== currentVersion) {
-      log(
-        "warn",
-        `${repo.serviceKey}: package.json (${currentVersion}) is behind the highest release tag on origin \u2014 using ${basisVersion} as the bump basis`
-      );
-      currentVersion = basisVersion;
-    }
-    const lastTag = await getLastTag(repo.localPath);
-    if (!lastTag) {
-      log("warn", `No tags found in ${repo.serviceKey} \u2014 skipping`);
-      continue;
-    }
-    const commits = await getCommitsSinceTag(repo.localPath, lastTag);
-    if (commits.length === 0) {
-      log("info", `${repo.serviceKey}: no changes since ${lastTag}`);
-      continue;
-    }
-    changes.push({
-      repo,
-      currentVersion,
-      newVersion: "",
-      // filled in step 2
-      commits,
-      tag: ""
-      // filled in step 2
-    });
-  }
-  return changes;
-}
-function rebaseImageTag(image, newVersion) {
-  if (/@sha256:[0-9a-f]{64}/i.test(image)) return image;
-  if (/:v[^:/]+$/.test(image)) {
-    return `${image.replace(/:v[^:/]+$/, "")}:v${newVersion}`;
-  }
-  return `${image}:v${newVersion}`;
-}
-function imageRepoPath(image) {
-  const withoutDigest = image.split("@")[0] ?? image;
-  const lastColon = withoutDigest.lastIndexOf(":");
-  const lastSlash = withoutDigest.lastIndexOf("/");
-  return lastColon > lastSlash ? withoutDigest.slice(0, lastColon) : withoutDigest;
-}
-function mayRebaseComponent(component, componentImage, ownImage) {
-  if (component && typeof component === "object" && component.versionLockstep === true) {
-    return true;
-  }
-  if (typeof ownImage !== "string" || ownImage.length === 0) return false;
-  return imageRepoPath(componentImage) === imageRepoPath(ownImage);
-}
-async function bumpVersions(changes, mode, dryRun) {
-  for (const change of changes) {
-    const newVersion = bumpVersion(change.currentVersion, mode);
-    change.newVersion = newVersion;
-    change.tag = `v${newVersion}`;
-    await assertVersionNotAlreadyReleased(change.repo.localPath, change.tag);
-    if (dryRun) {
-      log("dry", `${change.repo.serviceKey}: ${change.currentVersion} -> ${newVersion}`);
-      continue;
-    }
-    const pkgPath = path2.join(change.repo.localPath, "package.json");
-    const pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
-    pkg.version = newVersion;
-    writeFileSync2(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
-    const srf = readStackReleaseJson(change.repo.localPath);
-    if (srf) {
-      srf.version = newVersion;
-      srf.sourceVersion = newVersion;
-      if (typeof srf.image === "string") {
-        srf.image = rebaseImageTag(srf.image, newVersion);
-      }
-      const ownImage = typeof srf.image === "string" ? srf.image : void 0;
-      if (srf.components && typeof srf.components === "object") {
-        const components = srf.components;
-        for (const key of Object.keys(components)) {
-          const val = components[key];
-          if (typeof val === "string") {
-            if (mayRebaseComponent(val, val, ownImage)) {
-              components[key] = rebaseImageTag(val, newVersion);
-            }
-          } else if (val && typeof val === "object" && "image" in val) {
-            const obj = val;
-            if (typeof obj.image === "string" && mayRebaseComponent(obj, obj.image, ownImage)) {
-              obj.image = rebaseImageTag(obj.image, newVersion);
-            }
-          }
-        }
-      }
-      writeFileSync2(
-        path2.join(change.repo.localPath, "stack.release.json"),
-        JSON.stringify(srf, null, 2) + "\n"
-      );
-    }
-    await git(change.repo.localPath, "add", "package.json", "stack.release.json");
-    await git(change.repo.localPath, "commit", "-m", `chore: bump v${newVersion} for stack release`);
-    log("ok", `${change.repo.serviceKey}: bumped ${change.currentVersion} -> ${newVersion} (local commit, push deferred)`);
-  }
-}
-var RELEASE_PR_POLL_JQ = "[.state, .mergeable, .mergeStateStatus] | @tsv";
-async function landViaPR(repoPath, ghRepo, defaultBranch, branch, title) {
-  const pushedSha = await git(repoPath, "rev-parse", "HEAD");
-  await git(repoPath, "push", "--force-with-lease", "origin", `HEAD:refs/heads/${branch}`);
-  try {
-    await ghRun([
-      "pr",
-      "create",
-      "--repo",
-      ghRepo,
-      "--base",
-      defaultBranch,
-      "--head",
-      branch,
-      "--title",
-      title,
-      "--body",
-      "Automated release version bump \u2014 auto-merges when required CI is green."
-    ]);
-  } catch {
-  }
-  const deadline = Date.now() + 30 * 60 * 1e3;
-  let releasePr;
-  for (; ; ) {
-    try {
-      const output = await ghRun([
-        "pr",
-        "list",
-        "--repo",
-        ghRepo,
-        "--head",
-        branch,
-        "--state",
-        "all",
-        "--json",
-        "number,state,headRefOid"
-      ]);
-      releasePr = findPullRequestForHeadSha(JSON.parse(output), pushedSha);
-    } catch {
-    }
-    if (releasePr) break;
-    if (Date.now() > deadline) {
-      throw new Error(
-        `No PR on ${ghRepo} (${branch}) matches released commit ${pushedSha.slice(0, 12)} within 30m \u2014 failing closed rather than attributing another PR's verdict. Aborting release; ${defaultBranch} left untouched.`
-      );
-    }
-    await sleep(15e3);
-  }
-  if (releasePr.state !== "MERGED") {
-    await ghRun(["pr", "merge", String(releasePr.number), "--repo", ghRepo, "--auto", "--squash"]);
-  }
-  let lastMergeable = "";
-  for (; ; ) {
-    const observed = (await ghRun([
-      "pr",
-      "view",
-      String(releasePr.number),
-      "--repo",
-      ghRepo,
-      "--json",
-      "state,mergeable,mergeStateStatus",
-      "-q",
-      RELEASE_PR_POLL_JQ
-    ])).trim();
-    const [state, mergeable = "", mergeStateStatus = ""] = observed.split("	");
-    if (mergeable) lastMergeable = `mergeable=${mergeable} mergeStateStatus=${mergeStateStatus}`;
-    if (state === "MERGED") break;
-    if (mergeable === "CONFLICTING") {
-      throw new Error(
-        `Release PR ${ghRepo}#${releasePr.number} (${branch} @ ${pushedSha.slice(0, 12)}) CONFLICTS with ${defaultBranch}. GitHub cannot compute a merge commit for it, so NO CI will run and auto-merge can never fire \u2014 waiting would not help. Rebase the release branch and re-run. Aborting release; ${defaultBranch} left untouched.`
-      );
-    }
-    if (Date.now() > deadline) {
-      throw new Error(
-        `Release PR ${ghRepo}#${releasePr.number} (${branch} @ ${pushedSha.slice(0, 12)}) did not merge within 30m (${lastMergeable || "mergeability never readable"}). Aborting release; ${defaultBranch} left untouched.`
-      );
-    }
-    await sleep(3e4);
-  }
-  await git(repoPath, "fetch", "origin", defaultBranch);
-  await git(repoPath, "checkout", defaultBranch);
-  await git(repoPath, "reset", "--hard", `origin/${defaultBranch}`);
-}
-async function tagAndTriggerCI(changes, dryRun) {
-  for (const change of changes) {
-    if (dryRun) {
-      log("dry", `Would land ${change.repo.serviceKey} bump via PR + tag ${change.tag}`);
-      continue;
-    }
-    const branch = `release/bump-${change.tag}`;
-    await landViaPR(
-      change.repo.localPath,
-      change.repo.ghRepo,
-      change.repo.defaultBranch,
-      branch,
-      `chore: bump ${change.tag} for stack release`
-    );
-    change.releaseSha = await git(change.repo.localPath, "rev-parse", "HEAD");
-    await assertReleaseFreshness({
-      repoPath: change.repo.localPath,
-      defaultBranch: change.repo.defaultBranch,
-      releaseCommit: change.releaseSha
-    });
-    await printOpenPrGate({ ghRepo: change.repo.ghRepo, baseBranch: "main" });
-    await git(change.repo.localPath, "tag", change.tag);
-    await git(change.repo.localPath, "push", "origin", change.tag);
-    log("ok", `Landed ${change.repo.serviceKey} ${change.tag} via PR + tagged ${change.releaseSha.slice(0, 12)} (green-CI gated)`);
-  }
-}
-async function rollbackFailedReleases(changes, ciStatuses, dryRun) {
-  if (dryRun) return;
-  const failed = changes.filter((c) => {
-    const ci = ciStatuses.find((s) => s.repo.serviceKey === c.repo.serviceKey);
-    return ci && (ci.status !== "completed" || ci.conclusion !== "success");
-  });
-  if (failed.length === 0) return;
-  log("warn", `Rolling back ${failed.length} failed release(s)...`);
-  for (const change of failed) {
-    const name = repoName(change.repo);
-    try {
-      await git(change.repo.localPath, "push", "origin", `:refs/tags/${change.tag}`);
-      log("ok", `Deleted remote tag ${change.tag} from ${name}`);
-    } catch (err) {
-      log("warn", `Could not delete remote tag ${change.tag} from ${name}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    try {
-      await git(change.repo.localPath, "tag", "-d", change.tag);
-    } catch {
-    }
-    try {
-      await git(change.repo.localPath, "revert", "--no-edit", "HEAD");
-      await landViaPR(
-        change.repo.localPath,
-        change.repo.ghRepo,
-        change.repo.defaultBranch,
-        `release/revert-${change.tag}`,
-        `Revert bump ${change.tag} (release CI failed)`
-      );
-      log("ok", `Reverted bump commit for ${name} on ${change.repo.defaultBranch} (via PR)`);
-    } catch (err) {
-      log("fail", `Could not revert bump commit for ${name}: ${err instanceof Error ? err.message : String(err)}. Manual cleanup required.`);
-    }
-  }
-}
-function workflowRunHeadSha(run) {
-  return run.headSha ?? run.head_sha;
-}
-function findPullRequestForHeadSha(prs, pushedSha) {
-  const normalizedSha = pushedSha.toLowerCase();
-  return prs.find((pr) => pr.headRefOid?.toLowerCase() === normalizedSha);
-}
-function findWorkflowRunForHeadSha(runs, releaseSha) {
-  const normalizedReleaseSha = releaseSha.toLowerCase();
-  return runs.find((run) => workflowRunHeadSha(run)?.toLowerCase() === normalizedReleaseSha);
-}
-async function resolveReleaseSha(change) {
-  if (change.releaseSha) return change.releaseSha;
-  try {
-    change.releaseSha = await git(change.repo.localPath, "rev-parse", `${change.tag}^{}`);
-    return change.releaseSha;
-  } catch {
-    return void 0;
-  }
-}
-async function waitForCI(changes, dryRun) {
-  if (dryRun) {
-    return changes.map((c) => ({
-      repo: c.repo,
-      tag: c.tag,
-      status: "completed",
-      conclusion: "success"
-    }));
-  }
-  const TIMEOUT_MS = 15 * 60 * 1e3;
-  const POLL_INTERVAL_MS = 30 * 1e3;
-  const startTime = Date.now();
-  const statuses = changes.map((c) => ({
-    repo: c.repo,
-    tag: c.tag,
-    status: "in_progress"
-  }));
-  log("info", `Waiting for ${changes.length} CI build(s)... (timeout: 15m)`);
-  while (Date.now() - startTime < TIMEOUT_MS) {
-    const pending = statuses.filter((s) => s.status === "in_progress");
-    if (pending.length === 0) break;
-    for (const st of pending) {
-      try {
-        const change = changes.find((c) => c.repo.serviceKey === st.repo.serviceKey && c.tag === st.tag);
-        if (!change) continue;
-        const releaseSha = await resolveReleaseSha(change);
-        if (!releaseSha) continue;
-        const output = await ghRun([
-          "run",
-          "list",
-          "--repo",
-          st.repo.ghRepo,
-          "--workflow",
-          st.repo.releaseWorkflow,
-          "--limit",
-          "50",
-          "--json",
-          "status,conclusion,url,headSha"
-        ]);
-        const runs = JSON.parse(output);
-        const releaseRun = findWorkflowRunForHeadSha(runs, releaseSha);
-        if (!releaseRun) continue;
-        if (releaseRun.status === "completed") {
-          st.status = "completed";
-          st.conclusion = releaseRun.conclusion ?? "unknown";
-          st.url = releaseRun.url;
-          if (st.conclusion === "success") {
-            log("ok", `CI passed: ${st.repo.serviceKey} ${st.tag}`);
-          } else {
-            log("fail", `CI failed: ${st.repo.serviceKey} ${st.tag} (${st.conclusion}) \u2014 ${st.url}`);
-          }
-        }
-      } catch (err) {
-        log("warn", `Failed to check CI for ${st.repo.serviceKey}: ${err instanceof Error ? err.message : String(err)}`);
-      }
-    }
-    const stillPending = statuses.filter((s) => s.status === "in_progress");
-    if (stillPending.length === 0) break;
-    log("info", `${stillPending.length} CI build(s) still running... (${Math.round((Date.now() - startTime) / 1e3)}s elapsed)`);
-    await sleep(POLL_INTERVAL_MS);
-  }
-  for (const st of statuses) {
-    if (st.status === "in_progress") {
-      st.status = "timed_out";
-      log("fail", `CI timed out: ${st.repo.serviceKey} ${st.tag}`);
-    }
-  }
-  return statuses;
-}
-var PROXY_REGISTRY = "update.askexe.com";
-var GHCR_REGISTRY = "ghcr.io";
-function shortImageName(imageName) {
-  const parts = imageName.split("/");
-  return parts[parts.length - 1] ?? imageName;
-}
-async function checkRegistryManifest(registry, repo, tag, token) {
-  const url = `https://${registry}/v2/${repo}/manifests/${tag}`;
-  const headers = [
-    "-H",
-    "Accept: application/vnd.oci.image.index.v1+json",
-    // Also accept legacy Docker v2 manifest list / single manifest so the
-    // registry returns a Docker-Content-Digest for non-OCI images too.
-    "-H",
-    "Accept: application/vnd.docker.distribution.manifest.list.v2+json",
-    "-H",
-    "Accept: application/vnd.docker.distribution.manifest.v2+json"
-  ];
-  if (token) {
-    headers.push("-H", `Authorization: Bearer ${token}`);
-  }
-  try {
-    const { stdout } = await execFile("curl", [
-      "-sS",
-      "-m",
-      "30",
-      "-I",
-      ...headers,
-      url
-    ]);
-    const statusMatch = stdout.match(/^HTTP\/[\d.]+\s+(\d{3})/m);
-    const code = statusMatch ? parseInt(statusMatch[1], 10) : 0;
-    const digestMatch = stdout.match(/^docker-content-digest:\s*(sha256:[0-9a-f]{64})/im);
-    const digest = digestMatch ? digestMatch[1] : void 0;
-    return { status: code, ok: code >= 200 && code < 300, digest };
-  } catch {
-    return { status: 0, ok: false };
-  }
-}
-async function warmProxyCache(imageRef) {
-  try {
-    await execFile("docker", ["pull", imageRef], { timeout: 12e4 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function resolveDigestViaInspect(imageName, tag) {
-  const shortName = shortImageName(imageName);
-  const refs = [
-    `${GHCR_REGISTRY}/askexe/${shortName}:${tag}`,
-    `${PROXY_REGISTRY}/askexe/${shortName}:${tag}`
-  ];
-  for (const ref of refs) {
-    try {
-      const { stdout } = await execFile("docker", ["manifest", "inspect", ref, "--verbose"], {
-        timeout: 6e4
-      });
-      const parsed = JSON.parse(stdout);
-      let digest;
-      if (Array.isArray(parsed)) {
-        digest = parsed[0]?.Descriptor?.digest;
-      } else {
-        digest = parsed.Descriptor?.digest;
-      }
-      if (digest && /^sha256:[0-9a-f]{64}$/i.test(digest)) {
-        log("ok", `Resolved digest via docker manifest inspect: ${shortName}:${tag} -> ${digest.slice(0, 19)}...`);
-        return digest;
-      }
-    } catch {
-    }
-  }
-  try {
-    const ghcrRef = `${GHCR_REGISTRY}/askexe/${shortName}:${tag}`;
-    const { stdout } = await execFile("docker", ["manifest", "inspect", ghcrRef], {
-      timeout: 6e4
-    });
-    const parsed = JSON.parse(stdout);
-    if (parsed.digest && /^sha256:[0-9a-f]{64}$/i.test(parsed.digest)) {
-      log("ok", `Resolved digest via docker manifest inspect (non-verbose): ${shortName}:${tag} -> ${parsed.digest.slice(0, 19)}...`);
-      return parsed.digest;
-    }
-  } catch {
-  }
-  return void 0;
-}
-async function verifyImages(changes, ciStatuses, dryRun) {
-  if (dryRun) {
-    return changes.map((c) => ({
-      repo: c.repo,
-      tag: `v${c.newVersion}`,
-      ghcr: "ok",
-      proxy: "ok"
-    }));
-  }
-  const proxyToken = process.env.EXE_REGISTRY_PROXY_PULL_TOKEN ?? void 0;
-  const results = [];
-  let ghcrToken = process.env.GHCR_TOKEN?.trim() || void 0;
-  if (!ghcrToken) {
-    try {
-      const { stdout } = await execFile("gh", ["auth", "token"]);
-      ghcrToken = stdout.trim();
-    } catch {
-    }
-  }
-  const ghcrBearer = ghcrToken ? Buffer.from(ghcrToken).toString("base64") : void 0;
-  log("info", "Verifying Docker images are pullable (with retry for digest resolution)...");
-  for (const change of changes) {
-    const ci = ciStatuses.find((s) => s.repo.serviceKey === change.repo.serviceKey);
-    if (!ci || ci.status !== "completed" || ci.conclusion !== "success") continue;
-    const tag = `v${change.newVersion}`;
-    const shortName = shortImageName(change.repo.imageName);
-    const proxyRepo = `askexe/${shortName}`;
-    const ghcrRepo = `askexe/${shortName}`;
-    const result = {
-      repo: change.repo,
-      tag,
-      ghcr: "error",
-      proxy: "error"
-    };
-    const GHCR_RETRY_DELAYS = [5e3, 1e4, 2e4, 4e4];
-    let ghcrCheck = { status: 0, ok: false };
-    for (let attempt = 0; attempt <= GHCR_RETRY_DELAYS.length; attempt++) {
-      ghcrCheck = await checkRegistryManifest(GHCR_REGISTRY, ghcrRepo, tag, ghcrBearer);
-      if (ghcrCheck.ok && ghcrCheck.digest) {
-        break;
-      }
-      if (ghcrCheck.status === 401 || ghcrCheck.status === 403) {
-        break;
-      }
-      if (attempt < GHCR_RETRY_DELAYS.length) {
-        const delayMs = GHCR_RETRY_DELAYS[attempt];
-        log("info", `${shortName}:${tag} not yet available on GHCR (HTTP ${ghcrCheck.status}) \u2014 retry in ${delayMs / 1e3}s (${attempt + 1}/${GHCR_RETRY_DELAYS.length})`);
-        await sleep(delayMs);
-      }
-    }
-    if (ghcrCheck.ok) {
-      result.ghcr = "ok";
-      result.digest = ghcrCheck.digest;
-      if (!ghcrCheck.digest) {
-        log("warn", `${shortName}:${tag} is on GHCR but Docker-Content-Digest header missing \u2014 trying docker manifest inspect fallback`);
-        const inspectDigest = await resolveDigestViaInspect(change.repo.imageName, tag);
-        if (inspectDigest) {
-          result.digest = inspectDigest;
-        } else {
-          log("warn", `${shortName}:${tag} \u2014 docker manifest inspect also failed to resolve digest. Manifest entry will be tag-only.`);
-        }
-      }
-    } else if (ghcrCheck.status === 401 || ghcrCheck.status === 403) {
-      log("warn", `GHCR auth returned ${ghcrCheck.status} for ${shortName}:${tag} \u2014 trying docker manifest inspect fallback`);
-      const inspectDigest = await resolveDigestViaInspect(change.repo.imageName, tag);
-      if (inspectDigest) {
-        result.ghcr = "ok";
-        result.digest = inspectDigest;
-        log("ok", `${shortName}:${tag} \u2014 digest resolved via docker manifest inspect despite GHCR HEAD ${ghcrCheck.status}`);
-      } else {
-        result.ghcr = "error";
-        result.detail = `GHCR auth failed (${ghcrCheck.status}) and docker manifest inspect failed \u2014 cannot verify image. Fix gh auth or GHCR_TOKEN.`;
-        log("fail", `GHCR auth returned ${ghcrCheck.status} for ${shortName}:${tag} and inspect fallback failed \u2014 cannot verify`);
-      }
-    } else {
-      result.ghcr = "missing";
-      result.detail = `GHCR returned ${ghcrCheck.status} for ${ghcrRepo}:${tag} after ${GHCR_RETRY_DELAYS.length} retries`;
-      log("fail", `Image NOT FOUND on GHCR after retries: ${shortName}:${tag} \u2014 release may be broken!`);
-    }
-    const proxyCheck = await checkRegistryManifest(PROXY_REGISTRY, proxyRepo, tag, proxyToken);
-    if (proxyCheck.ok) {
-      result.proxy = "ok";
-      if (!result.digest && proxyCheck.digest) {
-        result.digest = proxyCheck.digest;
-      }
-    } else {
-      result.proxy = "pending";
-    }
-    if (result.ghcr === "ok" && result.proxy !== "ok") {
-      log("info", `Warming proxy cache for ${shortName}:${tag}...`);
-      const proxyRef = `${PROXY_REGISTRY}/${proxyRepo}:${tag}`;
-      const warmed = await warmProxyCache(proxyRef);
-      if (warmed) {
-        result.proxy = "ok";
-        log("ok", `Proxy cache warmed: ${shortName}:${tag}`);
-      } else {
-        result.proxy = "pending";
-        log("warn", `Could not warm proxy for ${shortName}:${tag} \u2014 GHCR has it, proxy will cache on first customer pull`);
-      }
-    }
-    if (result.ghcr === "ok" && result.proxy === "ok") {
-      const digestSuffix = result.digest ? ` [${result.digest.slice(0, 19)}...]` : "";
-      log("ok", `Image verified: ${shortName}:${tag} (GHCR + proxy)${digestSuffix}`);
-    } else if (result.ghcr === "ok" && result.proxy === "pending") {
-      log("warn", `Image on GHCR only: ${shortName}:${tag} (proxy will cache on first pull)`);
-    }
-    results.push(result);
-  }
-  return results;
-}
-function printImageVerification(results) {
-  if (results.length === 0) return;
-  console.log("\n  Image verification:");
-  for (const r of results) {
-    const shortName = shortImageName(r.repo.imageName);
-    const ghcrIcon = r.ghcr === "ok" ? "\x1B[32m\u2713\x1B[0m" : "\x1B[31m\u2717\x1B[0m";
-    const proxyIcon = r.proxy === "ok" ? "\x1B[32m\u2713\x1B[0m" : r.proxy === "pending" ? "\x1B[33m~\x1B[0m" : "\x1B[31m\u2717\x1B[0m";
-    const proxyLabel = r.proxy === "pending" ? "pending (first pull will cache)" : r.proxy;
-    console.log(
-      `    ${shortName}:${r.tag}`.padEnd(40) + `${ghcrIcon} GHCR  ${proxyIcon} proxy${r.proxy === "pending" ? ` (${proxyLabel})` : ""}`
-    );
-  }
-  console.log("");
-}
-async function updateStackManifest(changes, ciStatuses, dryRun, imageResults, canary = false) {
-  const manifest = JSON.parse(readFileSync2(MANIFEST_PATH, "utf8"));
-  const currentLatest = manifest.latest;
-  const currentParts = currentLatest.split(".").map(Number);
-  const newStackVersion = `${currentParts[0]}.${currentParts[1]}.${(currentParts[2] ?? 0) + 1}`;
-  const baseEntry = manifest.stacks[currentLatest];
-  const baseServices = baseEntry?.services ?? {};
-  const services = {};
-  for (const [key, svc] of Object.entries(baseServices)) {
-    services[key] = { ...svc };
-  }
-  const successfulChanges = [];
-  for (const change of changes) {
-    const ciStatus = ciStatuses.find((s) => s.repo.serviceKey === change.repo.serviceKey);
-    if (ciStatus && ciStatus.status === "completed" && ciStatus.conclusion === "success") {
-      successfulChanges.push(change);
-      const svc = services[change.repo.serviceKey];
-      if (svc) {
-        const tag = `v${change.newVersion}`;
-        const imageTag = `${change.repo.imageName}:${tag}`;
-        let digest = imageResults?.find((r) => r.repo.serviceKey === change.repo.serviceKey)?.digest;
-        if (!digest && !dryRun) {
-          log("info", `No digest from image verification for ${imageTag} \u2014 trying docker manifest inspect fallback (bug 85034df0)`);
-          digest = await resolveDigestViaInspect(change.repo.imageName, tag);
-        }
-        if (!digest && !dryRun) {
-          log("warn", `No content digest resolved for ${imageTag} \u2014 manifest entry will be tag-only and the digest-pinning gate will reject it.`);
-        }
-        svc.image = digest ? `${imageTag}@${digest}` : imageTag;
-        const gitSha = await resolveReleaseSha(change);
-        if (gitSha) {
-          svc.gitSha = gitSha;
-        } else if (!dryRun) {
-          log("warn", `No git SHA resolved for ${imageTag} \u2014 manifest entry will omit gitSha (G4 deploy-time provenance check will skip this service).`);
-        }
-      }
-    }
-  }
-  if (successfulChanges.length === 0 && !dryRun) {
-    log("warn", "No successful CI builds \u2014 manifest not updated");
-    return currentLatest;
-  }
-  const notesParts = [];
-  for (const change of successfulChanges) {
-    const summaries = change.commits.slice(0, 5).map((c) => {
-      const msg = c.replace(/^[a-f0-9]+ /, "");
-      return msg;
-    });
-    notesParts.push(`${change.repo.serviceKey} v${change.newVersion}: ${summaries.join("; ")}`);
-  }
-  const notes = notesParts.join(". ");
-  const exeOsVersion = readPackageVersion(EXE_OS_ROOT);
-  const newEntry = {
-    version: newStackVersion,
-    releasedAt: (/* @__PURE__ */ new Date()).toISOString().replace(/T.*/, "T00:00:00Z"),
-    notes,
-    npmVersion: exeOsVersion,
-    breakingChanges: [],
-    services,
-    // Staged rollout (release-safety canary hardening): "canary" entries are
-    // published (images pinned + pullable) but NOT promoted for implicit
-    // adoption — see assertRolloutStageAllowed in src/lib/stack-update.ts.
-    rolloutStage: canary ? "canary" : "ga"
-  };
-  if (dryRun) {
-    log("dry", `Would create stack ${newStackVersion} in manifest${canary ? " (CANARY \u2014 latest would NOT be bumped)" : ""}`);
-    log("dry", `Notes: ${notes}`);
-    return newStackVersion;
-  }
-  manifest.stacks[newStackVersion] = newEntry;
-  if (canary) {
-    writeSignedStackManifest(MANIFEST_PATH, manifest, { warn: (msg) => log("warn", msg) });
-    log("ok", `Stack manifest updated: added CANARY ${newStackVersion} (latest unchanged: ${currentLatest})`);
-    log("warn", `${newStackVersion} is a CANARY release. Deploy to a designated canary host with:`);
-    log("warn", `  exe-os stack-update --target ${newStackVersion} --yes`);
-    log("warn", `Then verify health (vps-health-gate / verify-stack) and promote with:`);
-    log("warn", `  exe-os stack-promote --version ${newStackVersion} --yes`);
-  } else {
-    manifest.latest = newStackVersion;
-    writeSignedStackManifest(MANIFEST_PATH, manifest, { warn: (msg) => log("warn", msg) });
-    log("ok", `Stack manifest updated: ${currentLatest} -> ${newStackVersion}`);
-  }
-  return newStackVersion;
-}
-function gatePublishWithPreflight(newStackVersion, dryRun, allowRed) {
-  let manifest;
-  try {
-    manifest = JSON.parse(readFileSync2(MANIFEST_PATH, "utf8"));
-  } catch (err) {
-    throw new Error(`Preflight gate: cannot read manifest ${MANIFEST_PATH}: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  const composeDir = path2.join(EXE_OS_ROOT, "deploy", "compose");
-  const report = runPreflightOnManifest({
-    manifest,
-    stackVersion: newStackVersion,
-    label: `${MANIFEST_PATH} (stack ${newStackVersion})`,
-    envExamplePath: path2.join(composeDir, ".env.example"),
-    composePath: path2.join(composeDir, "docker-compose.yml"),
-    monitorComposePath: path2.join(EXE_OS_ROOT, "deploy", "monitor", "docker-compose.hub.yml")
-  });
-  log("info", "Running static preflight gate against the freshly-written manifest...");
-  if (dryRun) {
-    console.log(`  [dry-run] preflight verdict: ${report.verdict} (pass ${report.passed} / warn ${report.warned} / fail ${report.failed})`);
-    if (report.verdict !== "GREEN") {
-      for (const f of report.findings) {
-        if (f.status !== "pass") log(report.verdict === "RED" && f.status === "fail" ? "fail" : "warn", `${f.check}: ${f.message}`);
-      }
-    }
-    return;
-  }
-  assertPreflightGate(report, {
-    context: "stack-release",
-    allowRed,
-    log: (m) => log("ok", m.replace(/^\[stack-release\]\s*/, "")),
-    warn: (m) => log("warn", m.replace(/^\[stack-release\]\s*/, ""))
-  });
-}
-function gatePreMutationStructure(changes, dryRun, allowRed) {
-  let baseManifest;
-  try {
-    baseManifest = JSON.parse(readFileSync2(MANIFEST_PATH, "utf8"));
-  } catch (err) {
-    throw new Error(`Pre-mutation gate: cannot read manifest ${MANIFEST_PATH}: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  const currentLatest = baseManifest.latest ?? "";
-  const baseServices = baseManifest.stacks?.[currentLatest]?.services ?? {};
-  const services = {};
-  for (const [key, svc] of Object.entries(baseServices)) services[key] = { ...svc };
-  for (const change of changes) {
-    const svc = services[change.repo.serviceKey];
-    if (svc) svc.image = `${change.repo.imageName}:v${change.newVersion}`;
-  }
-  const currentParts = currentLatest.split(".").map(Number);
-  const simVersion = `${currentParts[0] ?? 0}.${currentParts[1] ?? 9}.${(currentParts[2] ?? 0) + 1}`;
-  const simManifest = {
-    schemaVersion: 1,
-    latest: simVersion,
-    stacks: { [simVersion]: { version: simVersion, services } }
-  };
-  const composeDir = path2.join(EXE_OS_ROOT, "deploy", "compose");
-  const report = runPreflightOnManifest({
-    manifest: simManifest,
-    stackVersion: simVersion,
-    label: `pre-mutation simulated manifest (stack ${simVersion})`,
-    envExamplePath: path2.join(composeDir, ".env.example"),
-    composePath: path2.join(composeDir, "docker-compose.yml"),
-    monitorComposePath: path2.join(EXE_OS_ROOT, "deploy", "monitor", "docker-compose.hub.yml")
-  });
-  const adjusted = {
-    ...report,
-    findings: report.findings.map(
-      (f) => f.check === "digest-pinning" && f.status === "fail" ? { ...f, status: "warn", message: `${f.message} (pending image build \u2014 enforced after build)` } : f
-    )
-  };
-  const failed = adjusted.findings.filter((f) => f.status === "fail").length;
-  const warned = adjusted.findings.filter((f) => f.status === "warn").length;
-  const passed = adjusted.findings.filter((f) => f.status === "pass").length;
-  const verdict = failed > 0 ? "RED" : warned > 0 ? "YELLOW" : "GREEN";
-  const adjustedReport = { ...adjusted, verdict, failed, warned, passed };
-  log("info", "Running pre-mutation structural gate (before any remote push)...");
-  if (dryRun) {
-    console.log(`  [dry-run] pre-mutation verdict: ${adjustedReport.verdict} (pass ${passed} / warn ${warned} / fail ${failed})`);
-    for (const f of adjustedReport.findings) {
-      if (f.status !== "pass") log(f.status === "fail" ? "fail" : "warn", `${f.check}: ${f.message}`);
-    }
-    return;
-  }
-  assertPreflightGate(adjustedReport, {
-    context: "stack-release:pre-mutation",
-    allowRed,
-    log: (m) => log("ok", m.replace(/^\[stack-release:pre-mutation\]\s*/, "")),
-    warn: (m) => log("warn", m.replace(/^\[stack-release:pre-mutation\]\s*/, ""))
-  });
-}
-async function commitAndTagExeOs(newStackVersion, _exeOsChange, dryRun) {
-  if (dryRun) {
-    log("dry", `Would commit manifest + tag exe-os stack-v${newStackVersion}`);
-    return;
-  }
-  const status = await git(EXE_OS_ROOT, "status", "--porcelain", "deploy/stack-manifests/v0.9.json");
-  if (status) {
-    await git(EXE_OS_ROOT, "add", "deploy/stack-manifests/v0.9.json");
-    const commitMsg = `chore: stack release v${newStackVersion}`;
-    await git(EXE_OS_ROOT, "commit", "-m", commitMsg);
-    await landViaPR(EXE_OS_ROOT, "AskExe/exe-os", "main", `release/stack-v${newStackVersion}`, commitMsg);
-    log("ok", `Committed stack manifest v${newStackVersion} (via PR)`);
-  }
-  const stackTag = `stack-v${newStackVersion}`;
-  const releaseCommit = await git(EXE_OS_ROOT, "rev-parse", "HEAD");
-  await assertReleaseFreshness({
-    repoPath: EXE_OS_ROOT,
-    defaultBranch: "main",
-    releaseCommit
-  });
-  await printOpenPrGate({ ghRepo: "AskExe/exe-os", baseBranch: "main" });
-  try {
-    await git(EXE_OS_ROOT, "tag", stackTag);
-    await git(EXE_OS_ROOT, "push", "origin", stackTag);
-    log("ok", `Tagged exe-os ${stackTag}`);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    log("fail", `Failed to tag/push exe-os ${stackTag}: ${message}`);
-    throw new Error(
-      `Aborting: failed to tag/push exe-os ${stackTag}: ${message}. The manifest was committed but the stack-v tag that publishes it was not \u2014 customers will keep reading the previous manifest. Fix the cause and re-run; publishing is idempotent.`
-    );
-  }
-}
-function printSummary(changes, ciStatuses, newStackVersion, dryRun) {
-  const divider = "\u2500".repeat(70);
-  console.log(`
-${divider}`);
-  console.log(`  ${dryRun ? "[DRY RUN] " : ""}Stack Release Summary \u2014 v${newStackVersion}`);
-  console.log(divider);
-  console.log(
-    `  ${"Service".padEnd(14)} ${"Version".padEnd(20)} ${"Commits".padEnd(8)} ${"CI".padEnd(12)}`
-  );
-  console.log(`  ${"\u2500".repeat(14)} ${"\u2500".repeat(20)} ${"\u2500".repeat(8)} ${"\u2500".repeat(12)}`);
-  for (const change of changes) {
-    const ci = ciStatuses.find((s) => s.repo.serviceKey === change.repo.serviceKey);
-    const ciLabel = dryRun ? "\x1B[33mpending\x1B[0m" : ci?.status === "completed" && ci.conclusion === "success" ? "\x1B[32msuccess\x1B[0m" : ci?.status === "timed_out" ? "\x1B[31mtimed out\x1B[0m" : `\x1B[31m${ci?.conclusion ?? ci?.status ?? "unknown"}\x1B[0m`;
-    const versionStr = `${change.currentVersion} -> ${change.newVersion}`;
-    console.log(
-      `  ${change.repo.serviceKey.padEnd(14)} ${versionStr.padEnd(20)} ${String(change.commits.length).padEnd(8)} ${ciLabel}`
-    );
-  }
-  if (changes.length === 0) {
-    console.log("  No changes detected across any repo.");
-  }
-  console.log(divider);
-  if (!dryRun) {
-    const failed = ciStatuses.filter(
-      (s) => s.status !== "completed" || s.conclusion !== "success"
-    );
-    if (failed.length > 0) {
-      console.log("\n  \x1B[31mWarning:\x1B[0m Some CI builds failed. Check the links above.");
-    } else if (changes.length > 0) {
-      console.log(
-        `
-  \x1B[32mAll done.\x1B[0m Customers will pull new images from update.askexe.com on next stack-update.`
-      );
-    }
-  }
-  console.log("");
-}
-function log(level, msg) {
-  const prefix = {
-    info: "\x1B[36m[info]\x1B[0m",
-    ok: "\x1B[32m[ok]\x1B[0m",
-    warn: "\x1B[33m[warn]\x1B[0m",
-    fail: "\x1B[31m[fail]\x1B[0m",
-    dry: "\x1B[35m[dry-run]\x1B[0m"
-  };
-  console.log(`  ${prefix[level]} ${msg}`);
-}
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-async function confirm(message) {
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve) => {
-    rl.question(`
-  ${message} [y/N] `, (answer) => {
-      rl.close();
-      resolve(answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes");
-    });
-  });
-}
-function nextStackVersionForLock() {
-  try {
-    const manifest = JSON.parse(readFileSync2(MANIFEST_PATH, "utf8"));
-    const parts = String(manifest.latest ?? "0.9.0").split(".").map(Number);
-    return `stack-v${parts[0] ?? 0}.${parts[1] ?? 9}.${(parts[2] ?? 0) + 1}`;
-  } catch {
-    return "stack-vunknown";
-  }
-}
-async function currentReleaseBranch() {
-  try {
-    return await git(EXE_OS_ROOT, "branch", "--show-current") || "unknown";
-  } catch {
-    return "unknown";
-  }
-}
-function forceBuildRejection(flags) {
-  if (!flags.forceBuildRejected) return null;
-  return [
-    "--force-build is not supported and has been removed (bug b55695a5).",
-    "It never bypassed any gate: nothing downstream read it, images are built by tag push,",
-    "and docker.yml's green-CI gate stayed fully in force. It only printed a bypass banner.",
-    "Fix the red CI, or cut the release from a green SHA. Re-run without --force-build."
-  ].join("\n");
-}
-async function runStackRelease(flags) {
-  if (!flags.stack) {
-    console.error("Usage: exe-os release --stack [--dry-run] [--repos <list>] [--yes] [--skip-image-verify] [--allow-red] [--allow-dirty] [--canary] [--root <path>] [--force]");
-    process.exit(1);
-  }
-  if (flags.root) {
-    applyRootOverride(flags.root);
-  }
-  const forceBuildError = forceBuildRejection(flags);
-  if (forceBuildError) {
-    console.error(forceBuildError);
-    process.exit(1);
-  }
-  if (flags.force) {
-    console.warn("\n  \x1B[33;1m\u26A0  --force: release mutex override is ACTIVE\x1B[0m");
-    console.warn("  \x1B[33m   This only overrides ~/.exe-os/release.lock; freshness and publish gates still apply.\x1B[0m");
-    console.warn("  \x1B[33m   Use only after verifying no other release is actually running.\x1B[0m\n");
-  }
-  let releaseLock;
-  if (!flags.dryRun) {
-    releaseLock = acquireReleaseLock({
-      targetVersion: nextStackVersionForLock(),
-      branch: await currentReleaseBranch(),
-      force: flags.force,
-      log: (message) => log("warn", message)
-    });
-    log("ok", `Acquired release lock: ${releaseLock.lockPath}`);
-  }
-  try {
-    await assertCleanWorkingTree({ allowDirty: flags.allowDirty || flags.dryRun });
-    console.log(`
-  \x1B[1mexe-os stack release\x1B[0m${flags.dryRun ? " (dry run)" : ""}
-`);
-    const allRepos = buildRepoConfigs();
-    let repos;
-    if (flags.repos) {
-      repos = [];
-      for (const name of flags.repos) {
-        const match = allRepos.find(
-          (r) => r.serviceKey === name || r.ghRepo.endsWith(`/${name}`) || r.ghRepo === name
-        );
-        if (match) {
-          repos.push(match);
-        } else {
-          log("warn", `Unknown repo: ${name} \u2014 skipping`);
-        }
-      }
-      if (repos.length === 0) {
-        throw new Error("No valid repos specified.");
-      }
-    } else {
-      repos = allRepos;
-    }
-    repos = repos.filter((repo) => {
-      if (hasPackageJson(repo)) return true;
-      warnMissingRepoPackage(repo);
-      return false;
-    });
-    log("info", "Detecting changes across repos...");
-    const changes = await detectChanges(repos);
-    if (changes.length === 0) {
-      console.log("\n  No changes detected since last tags. Nothing to release.\n");
-      return;
-    }
-    const bumpMode = flags.major ? "major" : flags.minor ? "minor" : "patch";
-    for (const change of changes) {
-      const newVersion = bumpVersion(change.currentVersion, bumpMode);
-      change.newVersion = newVersion;
-      change.tag = `v${newVersion}`;
-    }
-    console.log("\n  Planned releases:");
-    for (const change of changes) {
-      console.log(
-        `    ${change.repo.serviceKey.padEnd(14)} ${change.currentVersion} -> ${change.newVersion}  (${change.commits.length} commit${change.commits.length === 1 ? "" : "s"})`
-      );
-    }
-    gatePreMutationStructure(changes, flags.dryRun, flags.allowRed);
-    if (!flags.yes && !flags.dryRun) {
-      const ok = await confirm("Proceed with release?");
-      if (!ok) {
-        console.log("  Aborted.\n");
-        return;
-      }
-    }
-    await bumpVersions(changes, bumpMode, flags.dryRun);
-    log("info", "Tagging repos and triggering CI...");
-    await tagAndTriggerCI(changes, flags.dryRun);
-    const ciStatuses = await waitForCI(changes, flags.dryRun);
-    const ciFailures = ciStatuses.filter(
-      (s) => s.status !== "completed" || s.conclusion !== "success"
-    );
-    if (ciFailures.length > 0 && !flags.dryRun) {
-      await rollbackFailedReleases(changes, ciStatuses, flags.dryRun);
-      const ciSuccesses = ciStatuses.filter(
-        (s) => s.status === "completed" && s.conclusion === "success"
-      );
-      if (ciSuccesses.length === 0) {
-        log("fail", "All CI builds failed. Release aborted, all bumps rolled back.");
-        throw new Error("All CI builds failed. Release aborted, all bumps rolled back.");
-      }
-      log("warn", `${ciFailures.length} CI build(s) failed and were rolled back. Continuing with ${ciSuccesses.length} successful build(s).`);
-    }
-    let imageResults = [];
-    if (flags.skipImageVerify) {
-      log("warn", "Image verification skipped (--skip-image-verify)");
-    } else {
-      imageResults = await verifyImages(changes, ciStatuses, flags.dryRun);
-      const failed = imageResults.filter((r) => (r.ghcr === "missing" || r.ghcr === "error") && r.proxy !== "ok");
-      if (failed.length > 0 && !flags.dryRun) {
-        for (const m of failed) {
-          log("fail", `${shortImageName(m.repo.imageName)}:${m.tag} \u2014 GHCR status: ${m.ghcr}, proxy: ${m.proxy} \u2014 cannot release`);
-        }
-        log("fail", "Aborting: images not verified. Fix GHCR auth/CI or use --skip-image-verify to override.");
-        throw new Error("Aborting: images not verified. Fix GHCR auth/CI or use --skip-image-verify to override.");
-      }
-      const pending = imageResults.filter((r) => r.proxy === "pending");
-      if (pending.length > 0) {
-        for (const p of pending) {
-          log("warn", `${shortImageName(p.repo.imageName)}:${p.tag} \u2014 proxy cache pending`);
-        }
-        if (!flags.dryRun) {
-          log("fail", "Aborting: proxy cache not ready for all images. Wait for proxy propagation or use --skip-image-verify.");
-          throw new Error("Aborting: proxy cache not ready for all images. Wait for proxy propagation or use --skip-image-verify.");
-        }
-      }
-      printImageVerification(imageResults);
-    }
-    log("info", "Updating stack manifest...");
-    const newStackVersion = await updateStackManifest(changes, ciStatuses, flags.dryRun, imageResults, flags.canary);
-    gatePublishWithPreflight(newStackVersion, flags.dryRun, flags.allowRed);
-    const exeOsChange = changes.find((c) => c.repo.serviceKey === "exe-os");
-    await commitAndTagExeOs(newStackVersion, exeOsChange, flags.dryRun);
-    printSummary(changes, ciStatuses, newStackVersion, flags.dryRun);
-    if (!flags.skipImageVerify && !flags.dryRun && imageResults.length > 0) {
-      const pendingImages = imageResults.filter((r) => r.proxy === "pending");
-      if (pendingImages.length > 0) {
-        log("info", "Re-checking proxy availability for pending images...");
-        for (const r of pendingImages) {
-          const shortName = shortImageName(r.repo.imageName);
-          const proxyRepo = `askexe/${shortName}`;
-          const proxyToken = process.env.EXE_REGISTRY_PROXY_PULL_TOKEN ?? void 0;
-          const recheck = await checkRegistryManifest(PROXY_REGISTRY, proxyRepo, r.tag, proxyToken);
-          if (recheck.ok) {
-            r.proxy = "ok";
-          }
-        }
-        printImageVerification(imageResults);
-      }
-    }
-  } finally {
-    releaseLock?.release();
-    if (releaseLock) log("ok", `Released release lock: ${releaseLock.lockPath}`);
-  }
-}
-export {
-  RELEASE_PR_POLL_JQ,
-  assertCleanWorkingTree,
-  assertReleaseFreshness,
-  assertVersionNotAlreadyReleased,
-  compareSemver,
-  deriveCloneUrl,
-  ensureRepoCloned,
-  findPullRequestForHeadSha,
-  findWorkflowRunForHeadSha,
-  forceBuildRejection,
-  getRemoteReleaseTags,
-  higherSemver,
-  highestReleasedVersion,
-  imageRepoPath,
-  isCloneTargetSafe,
-  isStrictSemverTag,
-  mayRebaseComponent,
-  parseReleaseArgs,
-  parseRemoteTagNames,
-  printOpenPrGate,
-  rebaseImageTag,
-  resolveVersionBasis,
-  runStackRelease
-};