@brainervirus/workit-cli 8.12.2 → 8.13.0

package/dist/index.js

@@ -65,7 +65,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.12.2",
+    version: "8.13.0",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -103,9 +103,9 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-core": "^8.12.2",
-      "@brainervirus/workit-cursor": "^8.12.2",
-      "@brainervirus/workit-opencode": "^8.12.2",
+      "@brainervirus/workit-core": "^8.13.0",
+      "@brainervirus/workit-cursor": "^8.13.0",
+      "@brainervirus/workit-opencode": "^8.13.0",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
@@ -13697,6 +13697,14 @@ var PREFIXES, branchNames = (workspaceRoot) => {
 }, repoBranchPreset = (workspaceRoot) => {
   const detected = detectBranchPolicy(workspaceRoot);
   return detected.developBranch || detected.allowed.length ? detected.preset : null;
+}, releaseTagPrefixOf = (workspaceRoot, policyPrefix) => {
+  if (typeof policyPrefix === "string")
+    return policyPrefix.trim();
+  const r = spawnSync5("git", ["config", "--get", "gitflow.prefix.versiontag"], {
+    cwd: workspaceRoot,
+    encoding: "utf8"
+  });
+  return r.status === 0 ? (r.stdout ?? "").trim() : "v";
 };
 var init_branch_policy = __esm(() => {
   init_config();
@@ -17303,17 +17311,49 @@ var init_branch = __esm(() => {
 var init_session_marker = __esm(() => {
   init_paths();
 });
+
+// packages/workit-core/src/hooks/shell-words.ts
+var init_shell_words = () => {};
+
 // packages/workit-core/src/hooks/raw-git.ts
-var SHELLS, PREFIXES2, CD, PUSHD, POPD, GIT_VALUE_OPTIONS, LAUNCHERS, PUSH_VALUE_OPTIONS, VALUE_OPTIONS;
+var SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLARATIONS, CD, PUSHD, POPD, GIT_VALUE_OPTIONS, GIT_CONFIG_OPTIONS, XARGS_VALUES, PARALLEL_VALUES, RECENT, LAUNCHERS, PUSH_VALUE_OPTIONS, VALUE_OPTIONS, API_VALUES, API_FIELDS, GIT_COMMANDS;
 var init_raw_git = __esm(() => {
   init_branch();
+  init_branch_policy();
   init_workspaces();
-  init_rev();
   init_ledger();
   init_paths();
   init_session_marker();
-  SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
-  PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "nice", "&"]);
+  init_shell_words();
+  SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "mksh", "yash", "fish"]);
+  POWERSHELLS = new Set(["pwsh", "powershell"]);
+  EVALS = new Set(["eval", "iex", "invoke-expression"]);
+  WRAPPERS = {
+    sudo: { values: "-u -g -h -p -C -D -R -T -r -t -U --user --group --host --prompt --chdir" },
+    doas: { values: "-u -C" },
+    command: { values: "" },
+    builtin: { values: "" },
+    env: { values: "-u -C --unset --chdir" },
+    nohup: { values: "" },
+    setsid: { values: "" },
+    time: { values: "-f -o --format --output" },
+    exec: { values: "-a" },
+    nice: { values: "-n --adjustment" },
+    ionice: { values: "-c -n -p --class --classdata" },
+    stdbuf: { values: "-i -o -e --input --output --error" },
+    chronic: { values: "" },
+    unbuffer: { values: "" },
+    wsl: { values: "-d -u --cd --distribution --user" },
+    timeout: { values: "-s -k --signal --kill-after", operands: 1 },
+    flock: { values: "-w -E --timeout --conflict-exit-code", operands: 1 },
+    coproc: { values: "" },
+    taskset: { values: "", operands: 1 },
+    watch: { values: "-n -d --interval --differences -q --equexit" },
+    "&": { values: "" }
+  };
+  WRAPPER_VALUES = new Map(Object.entries(WRAPPERS).map(([name, wrapper]) => [name, new Set(wrapper.values.split(" "))]));
+  KEYWORDS = new Set(["if", "then", "else", "elif", "while", "until", "do", "!", "{"]);
+  DECLARATIONS = new Set(["export", "local", "declare", "readonly", "typeset"]);
   CD = new Set(["cd", "chdir", "set-location", "sl"]);
   PUSHD = new Set(["pushd", "push-location"]);
   POPD = new Set(["popd", "pop-location"]);
@@ -17326,6 +17366,17 @@ var init_raw_git = __esm(() => {
     "--config-env",
     "--super-prefix"
   ]);
+  GIT_CONFIG_OPTIONS = new Set(["-c", "--config-env", "--git-dir"]);
+  XARGS_VALUES = new Set(["-n", "-L", "-l", "-P", "-d", "-E", "-e", "-s", "-a", "--arg-file", "--delimiter"].concat([
+    "--max-args",
+    "--max-lines",
+    "--max-procs",
+    "--eof",
+    "--max-chars",
+    "--process-slot-var"
+  ]));
+  PARALLEL_VALUES = new Set(["-j", "--jobs", "-N", "-n", "-S", "--sshlogin", "-P", "--delay"]);
+  RECENT = new Map;
   LAUNCHERS = new Set([
     "npx",
     "bunx",
@@ -17367,19 +17418,29 @@ var init_raw_git = __esm(() => {
     gh: new Set(["-b", "--body", "-F", "--body-file", "-t", "--title", "--subject", "-A", "--author-email"].concat(["-B", "--base", "-H", "--head", "-l", "--label", "-a", "--assignee"]).concat(["-r", "--reviewer", "-m", "--milestone", "-p", "--project", "-T", "--template"]).concat(["--match-head-commit", "-R", "--repo"])),
     glab: new Set(["-m", "--message", "--squash-message", "--sha", "-t", "--title", "-d", "--description"].concat(["-b", "--target-branch", "-s", "--source-branch", "-l", "--label"]).concat(["-a", "--assignee", "--reviewer", "-R", "--repo"]))
   };
+  API_VALUES = new Set(["--method", "--header", "--raw-field", "--field", "--jq", "--template", "--input"].concat([
+    "--hostname",
+    "--preview",
+    "--cache",
+    "--output"
+  ]));
+  API_FIELDS = new Set(["-f", "-F", "--raw-field", "--field"]);
+  GIT_COMMANDS = new Set(("add am annotate apply archive bisect blame branch bugreport bundle cat-file check-attr " + "check-ignore check-mailmap check-ref-format checkout checkout-index cherry cherry-pick " + "citool clean clone column commit commit-graph commit-tree config count-objects credential " + "daemon describe diagnose diff diff-files diff-index diff-tree difftool fast-export " + "fast-import fetch fetch-pack filter-branch fmt-merge-msg for-each-ref for-each-repo " + "format-patch fsck gc get-tar-commit-id grep gui hash-object help hook index-pack init " + "instaweb interpret-trailers lfs log ls-files ls-remote ls-tree mailinfo mailsplit " + "maintenance merge merge-base merge-file merge-index merge-tree mergetool mktag mktree " + "multi-pack-index mv name-rev notes pack-objects pack-refs patch-id prune pull push " + "range-diff read-tree rebase reflog remote repack replace request-pull rerere reset " + "restore rev-list rev-parse revert rm send-email shortlog show show-branch show-ref " + "sparse-checkout stage stash status stripspace submodule subtree switch symbolic-ref tag " + "update-index update-ref var verify-commit verify-pack verify-tag version whatchanged " + "worktree write-tree").split(" "));
 });
 
 // packages/workit-core/src/core/route-intent.ts
-var SWITCH_CREATE, CHECKOUT_CREATE, WORKTREE_CREATE, BRANCH_NO_CREATE, BRANCH_RENAME, WORKTREE_VALUES;
+var SWITCH_CREATE, CHECKOUT_CREATE, WORKTREE_CREATE, SUBTREE_CREATE, BRANCH_NO_CREATE, BRANCH_RENAME, WORKTREE_VALUES, FETCH_VALUES;
 var init_route_intent = __esm(() => {
   init_raw_git();
   init_branch();
   SWITCH_CREATE = new Set(["-c", "--create", "-C", "--force-create", "--orphan"]);
   CHECKOUT_CREATE = new Set(["-b", "-B", "--orphan"]);
   WORKTREE_CREATE = new Set(["-b", "-B"]);
+  SUBTREE_CREATE = new Set(["-b", "--branch"]);
   BRANCH_NO_CREATE = new Set(["-d", "-D", "--delete", "-l", "--list", "-a", "--all", "-r", "--remotes", "--show-current"].concat(["-v", "-vv", "--verbose", "--contains", "--no-contains", "--merged", "--no-merged"]).concat(["--points-at", "--sort", "--format", "--column", "--no-column", "-u"]).concat(["--set-upstream-to", "--unset-upstream", "--edit-description", "-i", "--ignore-case"]));
   BRANCH_RENAME = new Set(["-m", "-M", "--move", "-c", "-C", "--copy"]);
   WORKTREE_VALUES = new Set(["--reason"]);
+  FETCH_VALUES = new Set(["--depth", "--deepen", "--shallow-since", "--shallow-exclude", "--refmap", "-j", "--jobs"].concat(["--upload-pack", "-o", "--server-option", "--negotiation-tip", "--filter"]).concat(["--recurse-submodules-default", "--submodule-prefix", "-s", "--strategy", "-X"]).concat(["--strategy-option"]));
 });
 
 // packages/workit-core/src/core/runtime-identity.ts
@@ -74576,6 +74637,51 @@ ${gitOutput(run)}`);
     recorded: row.ok ? { id: String(row.value.id) } : { error: row.error }
   });
 }
+function releaseLinesOf(cwd) {
+  const { preset, branches, production } = releaseBranchesOf(cwd);
+  let policyPrefix;
+  try {
+    const selected = resolveRuntimeWorkspacePolicy(cwd, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined).policy;
+    policyPrefix = selected?.releaseTagPrefix;
+  } catch {
+    policyPrefix = undefined;
+  }
+  const prefix = releaseTagPrefixOf(cwd, policyPrefix);
+  const trunk = production ?? "main";
+  const lines = [
+    {
+      track: null,
+      production: branches[0] ?? trunk,
+      integration: branches[1] ?? trunk,
+      mergeBack: branches[1] ? [branches[1]] : [],
+      tagPrefix: prefix,
+      gitflow: branches.length > 0,
+      naming: {}
+    }
+  ];
+  let raw;
+  try {
+    raw = resolveRuntimeReleaseTracks(cwd)?.releaseTracks;
+  } catch {
+    return lines;
+  }
+  for (const track of readReleaseTracks(raw).tracks) {
+    const value = isRecord8(raw) ? raw[track.name] : undefined;
+    const entry = isRecord8(value) ? value : {};
+    const strategy = typeof entry.strategy === "string" ? entry.strategy : preset;
+    const namespace = typeof entry.tagNamespace === "string" ? entry.tagNamespace.trim() : "";
+    lines.push({
+      track: track.name,
+      production: track.productionBranch,
+      integration: track.integrationBranch,
+      mergeBack: track.mergeBackBranches.length ? track.mergeBackBranches : [track.integrationBranch],
+      tagPrefix: `${namespace}${prefix}`,
+      gitflow: strategy === "gitflow",
+      naming: { release: track.naming.release, hotfix: track.naming.hotfix }
+    });
+  }
+  return lines;
+}
 function releasePushPreflight(cwd, names) {
   const progress = operationInProgress(cwd);
   if (progress)
@@ -74583,7 +74689,16 @@ function releasePushPreflight(cwd, names) {
   const wanted = [...new Set(names)];
   if (!wanted.length)
     return failure3("invalid_input", "name the release refs to push");
-  const { preset, branches, production } = releaseBranchesOf(cwd);
+  const { preset, production } = releaseBranchesOf(cwd);
+  const lines = releaseLinesOf(cwd);
+  const tracks = lines.filter((line) => line.track !== null && line.gitflow);
+  const branches = [
+    ...new Set([
+      ...releaseBranchesOf(cwd).branches,
+      ...tracks.flatMap((line) => [line.production, line.integration, ...line.mergeBack])
+    ])
+  ];
+  const tagShape = `${lines[0].tagPrefix}<version>`;
   const refs = [];
   for (const raw of wanted) {
     if (raw.startsWith("-") || raw.includes(":"))
@@ -74595,16 +74710,22 @@ function releasePushPreflight(cwd, names) {
     if (tag && branch)
       return failure3("invalid_input", `${raw} names both a branch and a tag`, `workit git push --release refs/heads/${raw}  # or refs/tags/${raw}`);
     if (tag) {
-      const prefix = releaseTagPrefix(cwd);
-      if (!isReleaseTag(tagName, prefix))
-        return failure3("blocked", `release_push_refused: tag ${tagName} is not a release tag (${prefix}<version>, from ${prefix === "v" ? "the default" : "gitflow.prefix.versiontag"})`, `git tag -a ${prefix}<version> -m <message>  # then: workit git push --release ${prefix}<version>`);
-      refs.push({ kind: "tag", name: tagName, ref: `refs/tags/${tagName}`, sha: tag });
+      const line = lineOfTag(tagName, lines);
+      if (!line)
+        return failure3("blocked", `release_push_refused: tag ${tagName} is not a release tag (${tagShape})`, `git tag -a ${tagShape} -m <message>  # then: workit git push --release ${tagShape}`);
+      refs.push({
+        kind: "tag",
+        name: tagName,
+        ref: `refs/tags/${tagName}`,
+        sha: tag,
+        production: line.track === null ? production : line.production
+      });
       continue;
     }
     if (!branch)
       return failure3("not_found", `${raw} is not a local branch or tag`);
     if (!branches.some((name) => name.toLowerCase() === branchName.toLowerCase()))
-      return failure3("blocked", branches.length ? `release_push_refused: ${branchName} is not a git-flow release branch (${branches.join(", ")})` : `release_push_refused: the ${preset} policy lands ${branchName} only through a reviewed PR; workit git push --release pushes v<version> tags there, not branches`, branches.length ? "workit git push  # a feature, bugfix, release or hotfix branch, then: workit pr create" : `workit pr create --base ${branchName}  # then tag the merged commit and: workit git push --release v<version>`);
+      return failure3("blocked", branches.length ? `release_push_refused: ${branchName} is not a git-flow release branch (${branches.join(", ")})` : `release_push_refused: the ${preset} policy lands ${branchName} only through a reviewed PR; workit git push --release pushes ${tagShape} tags there, not branches`, branches.length ? "workit git push  # a feature, bugfix, release or hotfix branch, then: workit pr create" : `workit pr create --base ${branchName}  # then tag the merged commit and: workit git push --release ${tagShape}`);
     refs.push({ kind: "branch", name: branchName, ref: `refs/heads/${branchName}`, sha: branch });
   }
   const remote = pushRemoteName(cwd, refs.find((ref) => ref.kind === "branch")?.name ?? null);
@@ -74616,7 +74737,14 @@ function releasePushPreflight(cwd, names) {
   const local = parseRemoteUrl(raw)?.protocol === "file";
   if (!local && !pushTargetIsStable(cwd, raw))
     return failure3("blocked", `push_target_rewritten: the push URL of "${remote}" is rewritten by a url.*.insteadOf rule, so the destination is not the one checked`, "git config --get-regexp '^url\\.'  # remove the rewrite for this remote");
-  return success2({ refs, remote, url: redactRemote(raw), rawUrl: raw, local, production });
+  return success2({
+    refs,
+    remote,
+    url: redactRemote(raw),
+    rawUrl: raw,
+    local,
+    production
+  });
 }
 function executeReleasePush(cwd, plan, input) {
   const previous = new Map;
@@ -74633,20 +74761,20 @@ function executeReleasePush(cwd, plan, input) {
       return failure3("failed", `non_fast_forward: ${plan.remote}/${ref.name} (${before.sha.slice(0, 12)}) is not part of local ${ref.name}; a release push never rewrites it`, `git fetch ${plan.remote} ${ref.name} && git switch ${ref.name} && git merge --ff-only ${plan.remote}/${ref.name}  # then: workit git push --release ${ref.name}`);
   }
   const tags = plan.refs.filter((ref) => ref.kind === "tag");
-  if (tags.length) {
-    let productionTip = null;
-    if (plan.production) {
-      const tip = remoteRefTip(cwd, plan.rawUrl, `refs/heads/${plan.production}`);
+  const contains = (tip, sha) => git5(cwd, ["merge-base", "--is-ancestor", sha, tip]).ok;
+  for (const tag of tags) {
+    const production = tag.production ?? plan.production;
+    let remoteTip = null;
+    if (production) {
+      const tip = remoteRefTip(cwd, plan.rawUrl, `refs/heads/${production}`);
       if (!tip.ok)
         return failure3(tip.code, tip.error);
-      productionTip = tip.sha;
-    }
-    const contains = (tip, sha) => git5(cwd, ["merge-base", "--is-ancestor", sha, tip]).ok;
-    for (const tag of tags) {
-      const released = productionTip !== null && contains(productionTip, tag.sha) || plan.refs.some((ref) => ref.kind === "branch" && contains(ref.sha, tag.sha));
-      if (!released)
-        return failure3("blocked", `tag_unreleased: ${tag.name} (${tag.sha.slice(0, 12)}) is not on ${plan.remote}/${plan.production ?? "the production branch"}${plan.refs.some((ref) => ref.kind === "branch") ? " or a branch in this push" : ""}; a release tag marks a commit that already landed`, `land it through a PR first (workit pr create), git fetch ${plan.remote}, then tag the merged commit`);
+      remoteTip = tip.sha;
     }
+    const pushed = plan.refs.find((ref) => ref.kind === "branch" && ref.name.toLowerCase() === production?.toLowerCase());
+    const released = remoteTip !== null && contains(remoteTip, tag.sha) || pushed !== undefined && contains(pushed.sha, tag.sha);
+    if (!released)
+      return failure3("blocked", `tag_unreleased: ${tag.name} (${tag.sha.slice(0, 12)}) is not on ${plan.remote}/${production ?? "the production branch"}${pushed ? ` or the ${production} in this push` : ""}; a release tag marks a commit that already landed on its line's production branch`, `land it through a PR first (workit pr create), git fetch ${plan.remote}, then tag the merged commit`);
   }
   const pending = plan.refs.filter((ref) => previous.get(ref.ref) !== ref.sha);
   if (pending.length) {
@@ -74760,12 +74888,10 @@ ${run.stdout ?? ""}`).split(/\r?\n/u).map((value) => value.trimEnd()).filter((va
     ...lines.slice(-half)
   ].join(`
 `);
-}, validRefName = (cwd, name) => !name.startsWith("-") && git5(cwd, ["check-ref-format", "--branch", name]).ok, nulList = (text) => text.split("\x00").filter(Boolean), SESSION_SAFE, EXTRA_TRAILER, SESSION_KEY, TRAILER_LINE, sessionValues = (trailers) => trailers.filter((trailer) => SESSION_KEY.test(trailer)).map((trailer) => trailer.slice(trailer.indexOf(":") + 1).trim()), TRAILER_CONFIG, nothingToCommit = (what) => failure3("failed", `nothing_to_commit: ${what}`, "workit git commit --allow-empty -m '<msg>'  # only to record an empty commit on purpose"), SHA, SHA_PREFIX, releaseTagPrefix = (cwd) => {
-  const configured = git5(cwd, ["config", "--get", "gitflow.prefix.versiontag"]);
-  return configured.ok ? configured.stdout.trim() : "v";
-}, isReleaseTag = (name, prefix) => name.startsWith(prefix) && /^\d/u.test(name.slice(prefix.length));
+}, validRefName = (cwd, name) => !name.startsWith("-") && git5(cwd, ["check-ref-format", "--branch", name]).ok, nulList = (text) => text.split("\x00").filter(Boolean), SESSION_SAFE, EXTRA_TRAILER, SESSION_KEY, TRAILER_LINE, sessionValues = (trailers) => trailers.filter((trailer) => SESSION_KEY.test(trailer)).map((trailer) => trailer.slice(trailer.indexOf(":") + 1).trim()), TRAILER_CONFIG, nothingToCommit = (what) => failure3("failed", `nothing_to_commit: ${what}`, "workit git commit --allow-empty -m '<msg>'  # only to record an empty commit on purpose"), SHA, SHA_PREFIX, isRecord8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), lineOfTag = (tag, lines) => lines.filter((line) => tag.startsWith(line.tagPrefix) && /^\d/u.test(tag.slice(line.tagPrefix.length))).toSorted((a, b) => b.tagPrefix.length - a.tagPrefix.length)[0] ?? null;
 var init_ops = __esm(() => {
   init_branch();
+  init_branch_policy();
   init_commit_flavors();
   init_pr_create();
   init_release_tracks();
@@ -75792,7 +75918,7 @@ function stacksDir(cwd) {
   return { ok: true, data: path44.join(root.value.root, "stacks") };
 }
 function parseStack(raw) {
-  if (!isRecord8(raw) || !Array.isArray(raw.branches))
+  if (!isRecord9(raw) || !Array.isArray(raw.branches))
     return null;
   const name = str3(raw.name);
   const trunk = str3(raw.trunk);
@@ -75800,12 +75926,12 @@ function parseStack(raw) {
     return null;
   const branches = [];
   for (const item of raw.branches) {
-    if (!isRecord8(item))
+    if (!isRecord9(item))
       return null;
     const branch = str3(item.branch);
     if (!branch)
       return null;
-    const merged = isRecord8(item.merged) ? {
+    const merged = isRecord9(item.merged) ? {
       pr: typeof item.merged.pr === "number" ? item.merged.pr : null,
       mergeSha: str3(item.merged.mergeSha),
       at: str3(item.merged.at) ?? ""
@@ -75818,7 +75944,7 @@ function parseStack(raw) {
       lastParentHead: str3(item.lastParentHead),
       patchId: str3(item.patchId),
       merged,
-      ...isRecord8(item.pendingRestack) && str3(item.pendingRestack.from) && str3(item.pendingRestack.tip) && str3(item.pendingRestack.onto) ? {
+      ...isRecord9(item.pendingRestack) && str3(item.pendingRestack.from) && str3(item.pendingRestack.tip) && str3(item.pendingRestack.onto) ? {
         pendingRestack: {
           from: str3(item.pendingRestack.from),
           tip: str3(item.pendingRestack.tip),
@@ -76868,7 +76994,7 @@ ${run.stdout}`.split(`
       return false;
   }
   return true;
-}, isRecord8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str3 = (value) => typeof value === "string" && value ? value : null, LOCK_WAIT_MS3 = 2000, HEARTBEAT_MS = 20000, HEARTBEAT_STALE_MS, OWNERLESS_STALE_MS = 30000, OWNER = "owner", readOwner = (lock) => {
+}, isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str3 = (value) => typeof value === "string" && value ? value : null, LOCK_WAIT_MS3 = 2000, HEARTBEAT_MS = 20000, HEARTBEAT_STALE_MS, OWNERLESS_STALE_MS = 30000, OWNER = "owner", readOwner = (lock) => {
   let raw = null;
   try {
     raw = fs22.readFileSync(path44.join(lock, OWNER), "utf8");
@@ -77626,6 +77752,24 @@ function createGitHubForge(options) {
       if (node?.pullRequest?.number !== number)
         return success2(null);
       return success2(node.isResolved ? "resolved" : "open");
+    },
+    findRelease(tag) {
+      const found = rest(`repos/${repo}/releases/tags/${encodeRef(tag)}`, `release ${tag}`);
+      if (!found.ok)
+        return found.code === "not_found" ? success2(null) : found;
+      return success2({
+        tag: found.data.tag_name ?? tag,
+        url: safeUrl(found.data.html_url ?? null)
+      });
+    },
+    createRelease(input) {
+      const created = apiWrite(runner, "gh", apiHost, ["api", "-X", "POST", `repos/${repo}/releases`, "--input", "-"], `release ${input.tag}`, undefined, JSON.stringify({ tag_name: input.tag, name: input.name, body: input.body }));
+      if (!created.ok)
+        return created;
+      return success2({
+        tag: created.data.tag_name ?? input.tag,
+        url: safeUrl(created.data.html_url ?? null)
+      });
     }
   };
 }
@@ -78011,6 +78155,24 @@ ${squash.body}` : squash.subject
       if (!notes.some((note) => note.resolvable === true))
         return success2(null);
       return success2(notes.some((note) => note.resolvable === true && note.resolved !== true) ? "open" : "resolved");
+    },
+    findRelease(tag) {
+      const found = apiJson(runner, "glab", apiHost, api(`${project}/releases/${encodeURIComponent(tag)}`), `release ${tag}`);
+      if (!found.ok)
+        return found.code === "not_found" ? success2(null) : found;
+      return success2({
+        tag: found.data.tag_name ?? tag,
+        url: safeUrl2(found.data["_links"]?.self ?? null)
+      });
+    },
+    createRelease(input) {
+      const created = apiWrite(runner, "glab", apiHost, ["api", "-X", "POST", `${project}/releases`, "--input", "-"], `release ${input.tag}`, undefined, JSON.stringify({ tag_name: input.tag, name: input.name, description: input.body }));
+      if (!created.ok)
+        return created;
+      return success2({
+        tag: created.data.tag_name ?? input.tag,
+        url: safeUrl2(created.data["_links"]?.self ?? null)
+      });
     }
   };
 }
@@ -79616,12 +79778,700 @@ var init_verify = __esm(() => {
   SAFE_ARG = /^[0-9A-Za-z@/._~+-]+$/u;
 });
 
+// packages/workit-core/src/git/release.ts
+function lineFor(cwd, track) {
+  const lines = releaseLinesOf(cwd);
+  let name = track;
+  if (name === null && lines.length > 1) {
+    const resolved = vcsConfig("resolve", cwd);
+    if (resolved.ok === false)
+      return failure3("blocked", String(resolved.error));
+    if (resolved.releaseTrack?.blocking)
+      return failure3("blocked", String(resolved.releaseTrack.blocking), "pass --track <name>");
+    name = resolved.releaseTrack?.track?.name ?? null;
+  }
+  const line = lines.find((entry) => entry.track === name);
+  if (!line)
+    return failure3("invalid_input", `no release track ${JSON.stringify(name)} (configured: ${lines.map((entry) => entry.track).filter(Boolean).join(", ") || "none"})`);
+  return success2(line);
+}
+function releaseStart(cwd, input) {
+  const version = input.version.trim();
+  if (!validVersion(version))
+    return failure3("invalid_input", `${JSON.stringify(version)} is not a version (e.g. 1.4.0)`);
+  const kind = input.hotfix ? "hotfix" : "release";
+  const lineResult = lineFor(cwd, input.track ?? null);
+  if (!lineResult.ok)
+    return lineResult;
+  const line = lineResult.data;
+  const template = templateOf(line, kind);
+  const existing = git5(cwd, ["for-each-ref", "--format=%(refname:short)", "refs/heads"]).stdout.split(`
+`).filter((name) => name && versionIn(template, name) !== null);
+  if (existing.length)
+    return failure3("blocked", `release_exists: ${existing[0]} is still open; git-flow finishes one ${kind} before starting the next`, `workit release finish  # on ${existing[0]}`);
+  const tag = `${line.tagPrefix}${version}`;
+  if (resolveRef(cwd, `refs/tags/${tag}`))
+    return failure3("blocked", `tag_exists: ${tag} already exists`, "start the next version instead");
+  const base = kind === "hotfix" ? line.production : line.integration;
+  const remote = pushRemoteName(cwd, base);
+  if (remote) {
+    fetchRefs(cwd, remote, [`+refs/heads/${base}:refs/remotes/${remote}/${base}`]);
+    const local = resolveRef(cwd, `refs/heads/${base}`);
+    const tracked = resolveRef(cwd, `refs/remotes/${remote}/${base}`);
+    if (local && tracked && local !== tracked && !git5(cwd, ["merge-base", "--is-ancestor", local, tracked]).ok)
+      return failure3("blocked", `base_unpushed: local ${base} has commits ${remote}/${base} lacks; the ${kind} would start without them`, `land them on ${remote}/${base} first, or: git switch ${base} && git reset --keep ${remote}/${base}`);
+  }
+  const branched = gitBranch(cwd, {
+    name: branchFor(line, kind, version),
+    base,
+    ...line.track ? { track: line.track } : {}
+  });
+  if (!branched.ok)
+    return branched;
+  record2(cwd, input.actor, {
+    type: "release.started",
+    version,
+    kind,
+    branch: branched.data.branch,
+    head: branched.data.baseSha,
+    base,
+    track: line.track,
+    tag
+  });
+  return success2({
+    version,
+    kind,
+    branch: branched.data.branch,
+    base,
+    baseSha: branched.data.baseSha,
+    track: line.track,
+    tag,
+    notes: branched.data.notes
+  });
+}
+function locate(cwd, version, track) {
+  const lines = releaseLinesOf(cwd).filter((line) => track === null || line.track === track);
+  if (!lines.length)
+    return failure3("invalid_input", `no release track ${JSON.stringify(track)}`);
+  const rows = releaseRows(cwd);
+  const started = rows.filter((row) => row.type === "release.started");
+  const finished = new Set(rows.filter((row) => row.type === "release.finished").map((row) => String(row.branch)));
+  const startedRow = (branch) => started.findLast((row) => row.branch === branch && !finished.has(branch));
+  const lineOf = (branch, candidates) => {
+    const row = startedRow(branch);
+    const byRow = row ? candidates.find((line) => line.track === (row.track ?? null)) : undefined;
+    if (byRow)
+      return byRow;
+    const resolved = vcsConfig("resolve", cwd, { branch });
+    const name = resolved.ok === false ? null : resolved.releaseTrack?.track?.name ?? null;
+    return candidates.find((line) => line.track === name) ?? candidates[0];
+  };
+  const match = (branch) => {
+    const hits = [];
+    for (const line of lines)
+      for (const kind of KINDS) {
+        const found = versionIn(templateOf(line, kind), branch);
+        if (found)
+          hits.push({ line, kind, version: found });
+      }
+    if (!hits.length)
+      return null;
+    const line = lineOf(branch, hits.map((hit) => hit.line));
+    const hit = hits.find((entry) => entry.line === line) ?? hits[0];
+    return { ...hit, branch };
+  };
+  if (version !== null) {
+    if (!validVersion(version))
+      return failure3("invalid_input", `${JSON.stringify(version)} is not a version`);
+    for (const line of lines)
+      for (const kind of KINDS) {
+        const branch = branchFor(line, kind, version);
+        if (resolveRef(cwd, `refs/heads/${branch}`) || startedRow(branch)) {
+          const located = match(branch);
+          if (located)
+            return success2(located);
+        }
+      }
+    return failure3("not_found", `no release or hotfix branch for ${version} here, and none this ledger started`);
+  }
+  const current = currentBranch(cwd);
+  const here = current ? match(current) : null;
+  if (here)
+    return success2(here);
+  const open = started.findLast((row) => !finished.has(String(row.branch)));
+  if (open) {
+    const located = match(String(open.branch));
+    if (located)
+      return success2(located);
+  }
+  const branches = git5(cwd, ["for-each-ref", "--format=%(refname:short)", "refs/heads"]).stdout.split(`
+`).map((name) => name ? match(name) : null).filter((entry) => entry !== null);
+  if (branches.length === 1)
+    return success2(branches[0]);
+  return failure3(branches.length ? "invalid_input" : "not_found", branches.length ? `several releases are open (${branches.map((entry) => entry.branch).join(", ")}); name one` : "no release or hotfix branch to finish", branches.length ? `workit release finish ${branches[0].version}` : "workit release start <version>");
+}
+function changelogSection(cwd, ref, version) {
+  const shown = git5(cwd, ["show", `${ref}:CHANGELOG.md`]);
+  if (!shown.ok)
+    return null;
+  const lines = shown.stdout.split(/\r?\n/u);
+  const escaped = version.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+  const heading = new RegExp(`^(#{1,3})\\s+\\[?v?${escaped}\\]?(?:[\\s(]|$)`, "u");
+  const start = lines.findIndex((line) => heading.test(line));
+  if (start < 0)
+    return null;
+  const level = heading.exec(lines[start])?.[1].length ?? 2;
+  let end = lines.length;
+  for (let index = start + 1;index < lines.length; index += 1) {
+    const hashes = /^(#+)\s/u.exec(lines[index])?.[1].length;
+    if (hashes !== undefined && hashes <= level) {
+      end = index;
+      break;
+    }
+  }
+  const body = lines.slice(start + 1, end).join(`
+`).trim();
+  return body || null;
+}
+function planReleaseFinish(cwd, input) {
+  const progress = operationInProgress(cwd);
+  if (progress)
+    return inProgressFailure(progress.operation, "finish the release");
+  const located = locate(cwd, input.version?.trim() || null, input.track ?? null);
+  if (!located.ok)
+    return located;
+  const { line, kind, version, branch } = located.data;
+  const notes = [];
+  const dirty = git5(cwd, ["status", "--porcelain", "--untracked-files=no"]).stdout.trim();
+  if (dirty)
+    return failure3("blocked", "dirty_worktree: tracked files have uncommitted changes; a release finish merges on a clean tree", "workit git commit -m '<msg>' -- <paths>  # on the release branch, or stash them");
+  const tag = `${line.tagPrefix}${version}`;
+  const rows = releaseRows(cwd).filter((row) => row.branch === branch || row.release === branch);
+  const recordedOpen = rows.findLast((row) => row.type === "release.hotfix_target");
+  const openRelease = kind !== "hotfix" ? null : typeof recordedOpen?.target === "string" ? recordedOpen.target : git5(cwd, ["for-each-ref", "--format=%(refname:short)", "refs/heads"]).stdout.split(`
+`).find((name) => name && versionIn(templateOf(line, "release"), name) !== null) ?? null;
+  const mergeBack = openRelease ? [...new Set(line.mergeBack.map((name) => name === line.integration ? openRelease : name))] : line.mergeBack;
+  if (openRelease)
+    notes.push(`${openRelease} is open: the hotfix merges back into it instead of ${line.integration}`);
+  const remote = pushRemoteName(cwd, line.production);
+  if (remote) {
+    const wanted = [line.production, ...mergeBack, branch];
+    for (const name of wanted)
+      fetchRefs(cwd, remote, [`+refs/heads/${name}:refs/remotes/${remote}/${name}`]);
+  }
+  const branchTip = resolveRef(cwd, `refs/heads/${branch}`);
+  const remoteBranch = remote ? resolveRef(cwd, `refs/remotes/${remote}/${branch}`) : null;
+  const mergedRow = rows.findLast((row) => row.type === "release.merged");
+  const deletedRow = rows.findLast((row) => row.type === "release.branch_deleted");
+  const recordedTip = [mergedRow?.releaseTip, deletedRow?.head].find((value) => typeof value === "string");
+  const releaseTip = branchTip ?? recordedTip ?? null;
+  if (!releaseTip)
+    return failure3("not_found", `${branch} is gone and this ledger did not record its merge; nothing to resume`);
+  for (const name of [line.production, ...mergeBack]) {
+    const local = resolveRef(cwd, `refs/heads/${name}`);
+    const tracked = remote ? resolveRef(cwd, `refs/remotes/${remote}/${name}`) : null;
+    if (!local && tracked) {
+      const created = git5(cwd, ["branch", "--no-track", name, tracked]);
+      if (!created.ok)
+        return failure3("failed", `could not create local ${name}: ${gitError(created)}`);
+      notes.push(`created local ${name} from ${remote}/${name}`);
+      continue;
+    }
+    if (!local)
+      return failure3("not_found", `${name} exists neither locally nor on ${remote ?? "a remote"}`);
+    if (!tracked || name === openRelease)
+      continue;
+    if (!isAncestor3(cwd, tracked, local))
+      return failure3("blocked", `branch_behind: local ${name} is behind or diverged from ${remote}/${name}; git-flow finishes only onto up-to-date branches`, `git switch ${name} && git merge --ff-only ${remote}/${name}  # then: workit release finish ${version}`);
+    const productionTracked = remote ? resolveRef(cwd, `refs/remotes/${remote}/${line.production}`) : null;
+    const foreign = git5(cwd, [
+      "rev-list",
+      local,
+      `^${tracked}`,
+      `^${releaseTip}`,
+      ...productionTracked ? [`^${productionTracked}`] : []
+    ]).stdout.split(`
+`).filter(Boolean).filter((sha) => !(git5(cwd, ["rev-parse", "-q", "--verify", `${sha}^2`]).ok && isAncestor3(cwd, releaseTip, sha)));
+    if (foreign.length)
+      return failure3("blocked", `branch_ahead: local ${name} has ${foreign.length} commit(s) ${remote}/${name} lacks that are not part of ${branch}; the finish push would publish them`, `land them through review first, or: git switch ${name} && git reset --keep ${remote}/${name}  # then: workit release finish ${version}`);
+  }
+  if (branchTip && remoteBranch && !isAncestor3(cwd, remoteBranch, branchTip))
+    return failure3("blocked", `release_behind: ${remote}/${branch} has commits local ${branch} lacks`, `git switch ${branch} && git merge --ff-only ${remote}/${branch}`);
+  const production = resolveRef(cwd, `refs/heads/${line.production}`);
+  const merged = isAncestor3(cwd, releaseTip, production);
+  const localTag = resolveRef(cwd, `refs/tags/${tag}`);
+  if (localTag && !(isAncestor3(cwd, localTag, production) && isAncestor3(cwd, releaseTip, localTag)))
+    return failure3("blocked", `tag_exists: ${tag} (${localTag.slice(0, 12)}) is not this release's merge on ${line.production}`, "a release tag never moves; finish under the next version");
+  if (remote) {
+    const remoteTag = remoteRefTip(cwd, remote, `refs/tags/${tag}`);
+    if (remoteTag.ok && remoteTag.sha && remoteTag.sha !== localTag)
+      return failure3("blocked", `tag_exists: ${remote} already has ${tag} at ${remoteTag.sha.slice(0, 12)}`, "a release tag never moves; finish under the next version");
+  }
+  const recordedMerge = typeof mergedRow?.merge === "string" ? mergedRow.merge : null;
+  const tagTarget = localTag ?? (merged ? recordedMerge ?? production : null);
+  const state = {
+    merged,
+    tagged: localTag !== null,
+    mergedBack: Object.fromEntries(mergeBack.map((name) => [
+      name,
+      localTag !== null && isAncestor3(cwd, localTag, resolveRef(cwd, `refs/heads/${name}`))
+    ])),
+    branchDeleted: branchTip === null
+  };
+  return success2({
+    version,
+    kind,
+    branch,
+    track: line.track,
+    tag,
+    production: line.production,
+    mergeBack,
+    pushBranches: [line.production, ...mergeBack.filter((name) => name !== openRelease)],
+    openRelease,
+    gitflow: line.gitflow,
+    remote,
+    releaseTip,
+    published: remoteBranch,
+    tagTarget,
+    mergeRecorded: mergedRow !== undefined,
+    state,
+    changelog: changelogSection(cwd, branchTip ?? production, version),
+    notes,
+    warnings: integrationPrWarning(cwd, line.production)
+  });
+}
+function integrationPrWarning(cwd, production) {
+  try {
+    const selected = resolveRuntimeWorkspacePolicy(cwd, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined).policy;
+    return selected?.integration === "pr" ? [
+      `the workspace integration mode is pr: the remote may require pull requests on ${production}, which would reject the finish push`
+    ] : [];
+  } catch {
+    return [];
+  }
+}
+function finishLocally(cwd, plan, actor) {
+  const ran = [];
+  const base = { version: plan.version, release: plan.branch, tag: plan.tag, track: plan.track };
+  let tagTarget = plan.tagTarget;
+  if (plan.openRelease && !releaseRows(cwd).some((row) => row.type === "release.hotfix_target" && row.release === plan.branch))
+    record2(cwd, actor, {
+      type: "release.hotfix_target",
+      ...base,
+      branch: plan.branch,
+      target: plan.openRelease
+    });
+  if (plan.state.merged && !plan.mergeRecorded && tagTarget)
+    record2(cwd, actor, {
+      type: "release.merged",
+      ...base,
+      branch: plan.production,
+      head: tagTarget,
+      merge: tagTarget,
+      releaseTip: plan.releaseTip,
+      observed: true
+    });
+  if (!plan.state.merged) {
+    const on = switchTo(cwd, plan.production);
+    if (!on.ok)
+      return on;
+    const merged = mergeNoFf(cwd, plan.branch, plan.production, plan.version);
+    if (!merged.ok)
+      return merged;
+    tagTarget = merged.data;
+    ran.push("merge");
+    record2(cwd, actor, {
+      type: "release.merged",
+      ...base,
+      branch: plan.production,
+      head: merged.data,
+      merge: merged.data,
+      releaseTip: plan.releaseTip
+    });
+  }
+  if (!tagTarget)
+    return failure3("failed", `cannot tell which ${plan.production} commit to tag`);
+  if (!plan.state.tagged) {
+    const message = plan.changelog ?? `Release ${plan.version}`;
+    const tagged = git5(cwd, [
+      "tag",
+      "-a",
+      "--cleanup=verbatim",
+      plan.tag,
+      "-m",
+      message,
+      tagTarget
+    ]);
+    if (!tagged.ok)
+      return failure3("failed", `git tag ${plan.tag} failed: ${gitError(tagged)}`);
+    ran.push("tag");
+    record2(cwd, actor, {
+      type: "release.tagged",
+      ...base,
+      branch: plan.production,
+      head: tagTarget
+    });
+  }
+  for (const name of plan.mergeBack) {
+    if (plan.state.mergedBack[name])
+      continue;
+    const on = switchTo(cwd, name);
+    if (!on.ok)
+      return on;
+    const merged = mergeNoFf(cwd, plan.tag, name, plan.version);
+    if (!merged.ok)
+      return merged;
+    ran.push(`merge-back ${name}`);
+    record2(cwd, actor, { type: "release.merged_back", ...base, branch: name, head: merged.data });
+  }
+  if (!plan.state.branchDeleted) {
+    if (currentBranch(cwd) === plan.branch) {
+      const on = switchTo(cwd, plan.mergeBack.at(-1) ?? plan.production);
+      if (!on.ok)
+        return on;
+    }
+    const deleted = git5(cwd, ["branch", "-d", plan.branch]);
+    if (!deleted.ok)
+      return failure3("failed", `git branch -d ${plan.branch} failed: ${gitError(deleted)}`, plan.published ? `workit release publish ${plan.version}  # its remote copy lacks commits; then: workit release finish ${plan.version}` : undefined);
+    ran.push("delete-branch");
+    record2(cwd, actor, {
+      type: "release.branch_deleted",
+      ...base,
+      branch: plan.branch,
+      head: plan.releaseTip
+    });
+  }
+  return success2({ ran, tagTarget });
+}
+function recordReleaseStep(cwd, actor, plan, row) {
+  record2(cwd, actor, {
+    version: plan.version,
+    release: plan.branch,
+    tag: plan.tag,
+    track: plan.track,
+    ...row
+  });
+}
+function releaseToPublish(cwd, version) {
+  const located = locate(cwd, version, null);
+  if (!located.ok)
+    return located;
+  if (!resolveRef(cwd, `refs/heads/${located.data.branch}`))
+    return failure3("not_found", `${located.data.branch} is not a local branch`);
+  return located;
+}
+var VERSION, PLACEHOLDER3, validVersion = (version) => VERSION.test(version) && !version.includes("..") && !version.endsWith(".lock"), templateOf = (line, kind) => {
+  const template = line.naming[kind];
+  if (!template)
+    return `${kind}/{version}`;
+  return /\{[^}]*\}/u.test(template) ? template : `${template.replace(/\/?\*?$/u, "")}/{version}`;
+}, branchFor = (line, kind, version) => trackBranchName({ naming: line.naming }, kind, version) ?? `${kind}/${version}`, versionIn = (template, branch) => {
+  const pattern = template.split(PLACEHOLDER3).map((part) => part.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")).join("(.+)");
+  const match = new RegExp(`^${pattern}$`, "u").exec(branch);
+  return match?.[1] && validVersion(match[1]) ? match[1] : null;
+}, releaseRows = (cwd) => {
+  const ledger = readLedger(cwd);
+  if (!ledger.ok)
+    return [];
+  return ledger.value.rows.filter((row) => row.type.startsWith("release."));
+}, record2 = (cwd, actor, row) => {
+  appendObserved(cwd, { ...row, actor });
+}, KINDS, isAncestor3 = (cwd, ancestor, descendant) => git5(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]).ok, switchTo = (cwd, branch) => {
+  if (currentBranch(cwd) === branch)
+    return success2(undefined);
+  const switched = git5(cwd, ["switch", "-q", branch]);
+  return switched.ok ? success2(undefined) : failure3("failed", `git switch ${branch} failed: ${gitError(switched)}`);
+}, mergeNoFf = (cwd, what, into, version) => {
+  const merged = git5(cwd, ["merge", "--no-ff", "--no-edit", what], { timeoutMs: 10 * 60000 });
+  if (!merged.ok) {
+    const conflicted = git5(cwd, ["rev-parse", "-q", "--verify", "MERGE_HEAD"]).ok;
+    return failure3("failed", conflicted ? `merge_conflict: merging ${what} into ${into} conflicts` : `git merge ${what} into ${into} failed: ${gitError(merged)}`, conflicted ? `resolve the conflicts, git add <files>, git merge --continue, then: workit release finish ${version}` : undefined);
+  }
+  return success2(git5(cwd, ["rev-parse", "HEAD"]).stdout.trim());
+}, switchToRelease = (cwd, plan) => switchTo(cwd, plan.branch);
+var init_release = __esm(() => {
+  init_ledger();
+  init_vcs_config();
+  init_release_tracks();
+  init_workspaces();
+  init_ops();
+  init_rev();
+  VERSION = /^[0-9A-Za-z][0-9A-Za-z._+-]{0,99}$/u;
+  PLACEHOLDER3 = /\{[^}]*\}/gu;
+  KINDS = ["release", "hotfix"];
+});
+
+// packages/workit-cli/src/verbs/release.ts
+var exports_release = {};
+__export(exports_release, {
+  run: () => run14
+});
+async function subVerb(load, argv, io) {
+  let out = "";
+  let err = "";
+  const verb = await load();
+  await verb.run(argv, {
+    ...io,
+    json: true,
+    stdout: (text) => void (out += text),
+    stderr: (text) => void (err += text)
+  });
+  try {
+    return JSON.parse(out);
+  } catch {
+    return fail("failed", (out + err).trim() || `${argv.join(" ")} printed nothing`);
+  }
+}
+async function start(argv, io) {
+  const flags = parseFlags(argv, { hotfix: "boolean", track: "value" });
+  if (typeof flags === "string")
+    return usage3(io, flags, START_USAGE);
+  if (flags.positionals.length !== 1)
+    return usage3(io, flags.positionals.length ? "pass one version" : "missing <version>", START_USAGE);
+  const result = releaseStart(io.cwd, {
+    version: flags.positionals[0],
+    hotfix: flags.booleans.has("hotfix"),
+    track: flags.values.track ?? null,
+    actor: actorFromEnv(io.env)
+  });
+  if (!result.ok)
+    return forgeFail(io, result);
+  return emit(io, ok(result.data), (data) => [
+    `started ${data.branch} from ${data.base} (${short4(data.baseSha)}), local only; it will be tagged ${data.tag}`,
+    `next: commit the version bump, changelog and docs on ${data.branch} (workit git commit), then: workit release finish`,
+    ...data.notes.map((note) => `note: ${note}`)
+  ]);
+}
+async function releasePr(io, plan, dryRun) {
+  const title = `chore(release): ${plan.version}`;
+  if (dryRun)
+    return emit(io, ok({
+      ...plan,
+      steps: [`push ${plan.branch}`, `open a PR ${plan.branch} -> ${plan.production}: ${title}`]
+    }), () => [
+      `would push ${plan.branch} and open a release PR into ${plan.production} (not git-flow: the trunk moves only through review)`
+    ]);
+  const switched = switchToRelease(io.cwd, plan);
+  if (!switched.ok)
+    return forgeFail(io, switched);
+  const pushed = await subVerb(() => Promise.resolve().then(() => (init_git2(), exports_git)), ["push", "--set-upstream"], io);
+  if (!pushed.ok)
+    return emit(io, pushed);
+  const pr = await subVerb(() => Promise.resolve().then(() => (init_pr(), exports_pr)), [
+    "create",
+    "--base",
+    plan.production,
+    "--title",
+    title,
+    `--body=${plan.changelog ?? `Release ${plan.version}`}`
+  ], io);
+  if (!pr.ok)
+    return emit(io, pr);
+  recordReleaseStep(io.cwd, actorFromEnv(io.env), plan, {
+    type: "release.pr_opened",
+    branch: plan.branch,
+    pr: pr.data.number ?? null
+  });
+  return emit(io, ok({ ...plan, pr: pr.data }), () => [
+    `opened the release PR ${String(pr.data.url ?? "")} into ${plan.production}`,
+    `next: once it merges, tag the merged commit ${plan.tag} and: workit git push --release ${plan.tag}`
+  ]);
+}
+async function finish2(argv, io) {
+  const flags = parseFlags(argv, { track: "value", "dry-run": "boolean" });
+  if (typeof flags === "string")
+    return usage3(io, flags, FINISH_USAGE);
+  if (flags.positionals.length > 1)
+    return usage3(io, `unexpected argument ${flags.positionals[1]}`, FINISH_USAGE);
+  const dryRun = flags.booleans.has("dry-run");
+  const planned = planReleaseFinish(io.cwd, {
+    version: flags.positionals[0] ?? null,
+    track: flags.values.track ?? null
+  });
+  if (!planned.ok)
+    return forgeFail(io, planned);
+  const plan = planned.data;
+  if (!plan.gitflow) {
+    if (!dryRun && plan.state.branchDeleted)
+      return emit(io, fail("not_found", `${plan.branch} is gone; nothing to open a PR from`));
+    return releasePr(io, plan, dryRun);
+  }
+  const actor = actorFromEnv(io.env);
+  const local = isLocalRemote(io.cwd, plan.remote);
+  const release = requireGrant(io.cwd, "release");
+  const push = requireGrant(io.cwd, "push", { forge: !local });
+  const steps = stepsOf(plan);
+  for (const warning of plan.warnings)
+    io.stderr(`warning: ${warning}
+`);
+  const warned = (envelope) => plan.warnings.length ? { ...envelope, warnings: plan.warnings } : envelope;
+  if (dryRun) {
+    const missing = [release, push].find((grant) => !grant.allowed);
+    const data = { ...plan, steps, grants: { release: release.allowed, push: push.allowed } };
+    if (missing && !missing.allowed)
+      return emit(io, warned(fail("blocked", missing.error, { unblock: missing.unblock, data })));
+    return emit(io, warned(ok(data)), () => [
+      `finish ${plan.branch} -> ${plan.production} as ${plan.tag}:`,
+      ...steps.map((entry) => `  ${entry.done ? "done" : "todo"}  ${entry.step}`)
+    ]);
+  }
+  if (!release.allowed)
+    return blocked(io, release);
+  if (!push.allowed)
+    return blocked(io, push);
+  const resume = `workit release finish ${plan.version}${plan.track ? ` --track ${plan.track}` : ""}`;
+  const merged = finishLocally(io.cwd, plan, actor);
+  if (!merged.ok)
+    return forgeFail(io, merged, { step: "merge", resume });
+  const notes = [...plan.notes];
+  const pushed = await subVerb(() => Promise.resolve().then(() => (init_git2(), exports_git)), ["push", ...[...plan.pushBranches, plan.tag].flatMap((ref) => ["--release", ref])], io);
+  if (!pushed.ok)
+    return emit(io, { ...pushed, data: { ...pushed.data, step: "push", resume } });
+  if (plan.published && plan.remote) {
+    const removed = deleteRemoteBranch(io.cwd, plan.remote, plan.branch, plan.published);
+    notes.push(removed.ok ? `deleted ${plan.remote}/${plan.branch}` : `kept ${plan.remote}/${plan.branch}: ${removed.error}`);
+    if (removed.ok)
+      recordReleaseStep(io.cwd, actor, plan, {
+        type: "release.remote_branch_deleted",
+        branch: plan.branch,
+        head: plan.published
+      });
+  }
+  let forgeRelease = null;
+  if (local)
+    notes.push(`${plan.remote ?? "the remote"} is a local path: no forge release`);
+  else {
+    const connected = connect(io);
+    if (!connected.ok)
+      return forgeFail(io, connected, { step: "forge-release", resume });
+    const forge = connected.data.forge;
+    const found = forge.findRelease(plan.tag);
+    if (!found.ok)
+      return forgeFail(io, found, { step: "forge-release", resume });
+    if (found.data)
+      forgeRelease = { url: found.data.url, created: false };
+    else {
+      const created = forge.createRelease({
+        tag: plan.tag,
+        name: plan.tag,
+        body: plan.changelog ?? `Release ${plan.version}`
+      });
+      if (!created.ok)
+        return forgeFail(io, created, { step: "forge-release", resume });
+      forgeRelease = { url: created.data.url, created: true };
+    }
+    recordReleaseStep(io.cwd, actor, plan, {
+      type: "release.forge_released",
+      branch: plan.production,
+      url: forgeRelease.url,
+      created: forgeRelease.created
+    });
+  }
+  const verified = verifyReleased(io.cwd, { tag: plan.tag, actor }, forgeDeps.npm);
+  if (!verified.ok)
+    return forgeFail(io, verified, { step: "verify", resume });
+  if (!verified.data.delivered)
+    return emit(io, fail("failed", `release_unverified: ${plan.tag} is not on ${plan.remote ?? "the remote"}`, {
+      data: { step: "verify", resume, report: verified.data },
+      unblock: resume
+    }));
+  recordReleaseStep(io.cwd, actor, plan, {
+    type: "release.finished",
+    branch: plan.branch,
+    head: merged.data.tagTarget
+  });
+  return emit(io, warned(ok({ ...plan, ran: merged.data.ran, push: pushed.data, forgeRelease, notes })), () => [
+    `finished ${plan.branch}: ${plan.production} and ${plan.mergeBack.join(", ")} merged, ${plan.tag} tagged on ${short4(merged.data.tagTarget)}`,
+    `pushed ${[...plan.pushBranches, plan.tag].join(", ")} to ${plan.remote ?? "the remote"}; remote tips verified`,
+    ...forgeRelease ? [
+      `forge release ${plan.tag}${forgeRelease.created ? " created" : " already there"}${forgeRelease.url ? `: ${forgeRelease.url}` : ""}`
+    ] : [],
+    ...notes.map((note) => `note: ${note}`)
+  ]);
+}
+async function publish(argv, io) {
+  const flags = parseFlags(argv, {});
+  if (typeof flags === "string")
+    return usage3(io, flags, PUBLISH_USAGE);
+  if (flags.positionals.length > 1)
+    return usage3(io, `unexpected argument ${flags.positionals[1]}`, PUBLISH_USAGE);
+  const located = releaseToPublish(io.cwd, flags.positionals[0] ?? null);
+  if (!located.ok)
+    return forgeFail(io, located);
+  const plan = pushPreflight(io.cwd, { branch: located.data.branch });
+  if (!plan.ok)
+    return forgeFail(io, plan);
+  const identity = plan.data.local ? null : pushIdentity(io, plan.data.branch);
+  if (identity && !identity.ok)
+    return forgeFail(io, identity);
+  const checked = identity?.data ?? null;
+  const grant = requireGrant(io.cwd, "push", { forge: checked?.forge != null });
+  if (!grant.allowed)
+    return blocked(io, grant);
+  const actor = actorFromEnv(io.env);
+  const result = executePush(io.cwd, plan.data, {
+    setUpstream: true,
+    actor,
+    ...checked ? { identity: { ...checked } } : {}
+  });
+  if (!result.ok)
+    return forgeFail(io, result);
+  appendObserved(io.cwd, {
+    type: "release.published",
+    actor,
+    version: located.data.version,
+    branch: located.data.branch,
+    head: result.data.sha
+  });
+  return emit(io, ok({ ...result.data, version: located.data.version }), (data) => [
+    `published ${data.branch} (${short4(data.sha)}) to ${data.remote}; remote tip verified`
+  ]);
+}
+async function run14(argv, io) {
+  const [sub, ...rest] = argv;
+  if (sub === "start")
+    return start(rest, io);
+  if (sub === "finish")
+    return finish2(rest, io);
+  if (sub === "publish")
+    return publish(rest, io);
+  return usage3(io, sub && !sub.startsWith("-") ? `unknown release subcommand "${sub}"` : "missing release subcommand", USAGE6);
+}
+var START_USAGE = "workit release start <version> [--hotfix] [--track <t>] [--json]", FINISH_USAGE = "workit release finish [<version>] [--track <t>] [--dry-run] [--json]", PUBLISH_USAGE = "workit release publish [<version>] [--json]", USAGE6 = "workit release start|finish|publish ... (workit help release)", short4 = (sha) => sha ? sha.slice(0, 12) : "(none)", blocked = (io, grant) => emit(io, fail("blocked", grant.error, { unblock: grant.unblock, data: { reason: grant.reason } })), isLocalRemote = (cwd, remote) => {
+  const url = remote ? pushUrl(cwd, remote) : null;
+  return !url || parseRemoteUrl(url)?.protocol === "file";
+}, stepsOf = (plan) => [
+  { step: `merge ${plan.branch} into ${plan.production} (--no-ff)`, done: plan.state.merged },
+  { step: `tag ${plan.tag} (annotated)`, done: plan.state.tagged },
+  ...plan.mergeBack.map((name) => ({
+    step: `merge ${plan.tag} into ${name} (--no-ff)`,
+    done: plan.state.mergedBack[name] === true
+  })),
+  { step: `delete local ${plan.branch}`, done: plan.state.branchDeleted },
+  {
+    step: `push ${[...plan.pushBranches, plan.tag].join(", ")} (atomic, fast-forward only)`,
+    done: false
+  },
+  { step: `forge release ${plan.tag}`, done: false },
+  { step: `verify ${plan.tag} on the remote`, done: false }
+];
+var init_release2 = __esm(() => {
+  init_autonomy();
+  init_verify();
+  init_ops();
+  init_release();
+  init_rev();
+  init_ledger();
+  init_output();
+  init_forge_common();
+});
+
 // packages/workit-cli/src/verbs/verify-delivery.ts
 var exports_verify_delivery = {};
 __export(exports_verify_delivery, {
-  run: () => run14
+  run: () => run15
 });
-async function run14(argv, io) {
+async function run15(argv, io) {
   const flags = parseFlags(argv, {
     expect: "value",
     branch: "value",
@@ -79631,31 +80481,31 @@ async function run14(argv, io) {
     package: "value"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, USAGE6);
+    return usage3(io, flags, USAGE7);
   if (flags.positionals.length > 1)
-    return usage3(io, `unexpected argument ${flags.positionals[1]}`, USAGE6);
+    return usage3(io, `unexpected argument ${flags.positionals[1]}`, USAGE7);
   const named = flags.positionals[0];
   if (named !== undefined && !ENDPOINTS[named])
-    return usage3(io, `unknown endpoint "${named}"`, USAGE6);
+    return usage3(io, `unknown endpoint "${named}"`, USAGE7);
   if (flags.values.expect !== undefined && !ENDPOINTS[flags.values.expect])
-    return usage3(io, "--expect must be pushed, pr, merged or released", USAGE6);
+    return usage3(io, "--expect must be pushed, pr, merged or released", USAGE7);
   if (named && flags.values.expect && ENDPOINTS[named] !== ENDPOINTS[flags.values.expect])
-    return usage3(io, `${named} and --expect ${flags.values.expect} disagree`, USAGE6);
+    return usage3(io, `${named} and --expect ${flags.values.expect} disagree`, USAGE7);
   const expect = ENDPOINTS[named ?? ""] ?? ENDPOINTS[flags.values.expect ?? ""] ?? (flags.values.tag || flags.values.package ? "released" : flags.values.pr ? "pr" : "pushed");
   const pr = positiveInt(flags.values.pr, "--pr");
   if (typeof pr === "string")
-    return usage3(io, pr, USAGE6);
+    return usage3(io, pr, USAGE7);
   if (pr && flags.values.branch)
-    return usage3(io, "pass --pr or --branch, not both", USAGE6);
+    return usage3(io, "pass --pr or --branch, not both", USAGE7);
   const sha = flags.values.sha ?? null;
   if (sha !== null && !/^[0-9a-f]{7,64}$/u.test(sha))
-    return usage3(io, "--sha must be a commit sha (7-64 hex chars)", USAGE6);
+    return usage3(io, "--sha must be a commit sha (7-64 hex chars)", USAGE7);
   const actor = actorFromEnv(io.env);
   const branch = flags.values.branch ?? null;
   let result;
   if (expect === "pushed") {
     if (pr)
-      return usage3(io, "push is checked by --branch, not --pr", USAGE6);
+      return usage3(io, "push is checked by --branch, not --pr", USAGE7);
     result = verifyPushed(io.cwd, { branch, sha, actor });
   } else if (expect === "released") {
     result = verifyReleased(io.cwd, { tag: flags.values.tag ?? null, pkg: flags.values.package ?? null, sha, actor }, forgeDeps.npm);
@@ -79680,7 +80530,7 @@ async function run14(argv, io) {
     unblock: expect === "pushed" ? "workit git push" : expect === "pr" ? "workit git push && workit pr create --fill" : expect === "merged" ? "workit pr status  # then workit pr merge when READY and granted" : "check the release workflow; the tag/package is not published"
   }));
 }
-var USAGE6 = "workit verify-delivery [push|pr|merge|release] [--expect pushed|pr|merged|released] [--branch <b>] [--pr <n>] [--sha <sha>] [--tag <t>] [--package <name[@version]>] [--json]", ENDPOINTS, render2 = (report) => [
+var USAGE7 = "workit verify-delivery [push|pr|merge|release] [--expect pushed|pr|merged|released] [--branch <b>] [--pr <n>] [--sha <sha>] [--tag <t>] [--package <name[@version]>] [--json]", ENDPOINTS, render2 = (report) => [
   `${report.expect}: ${report.delivered ? "delivered" : "NOT delivered"}${report.branch ? ` (${report.branch}${report.sha ? ` @ ${report.sha.slice(0, 12)}` : ""})` : ""}${report.pr ? ` #${report.pr}` : ""}`,
   ...report.observations.map((entry) => `  ${entry.ok ? "ok" : "x "} ${entry.kind}: expected ${entry.expected ?? "-"}, observed ${entry.observed ?? "(none)"}${entry.note ? ` — ${entry.note}` : ""}`)
 ];
@@ -79703,7 +80553,7 @@ var init_verify_delivery = __esm(() => {
 // packages/workit-cli/src/verbs/stack.ts
 var exports_stack = {};
 __export(exports_stack, {
-  run: () => run15
+  run: () => run16
 });
 async function plan(argv, io) {
   const flags = parseFlags(argv, { name: "value", trunk: "value", track: "value" });
@@ -79877,7 +80727,7 @@ async function land(argv, io) {
     ...data.dryRun ? [
       data.wouldLand.length ? `would land: ${data.wouldLand.map((item) => `${label2(kind, item.pr)} (${item.branch})`).join(", ")}` : "would land nothing"
     ] : [
-      data.landed.length ? `landed: ${data.landed.map((item) => `${label2(kind, item.pr)} (${item.branch}) -> ${short4(item.mergeSha)}${item.unverified ? ` UNVERIFIED (ledger ${item.unverified})` : ""}`).join(", ")}` : "landed nothing"
+      data.landed.length ? `landed: ${data.landed.map((item) => `${label2(kind, item.pr)} (${item.branch}) -> ${short5(item.mergeSha)}${item.unverified ? ` UNVERIFIED (ledger ${item.unverified})` : ""}`).join(", ")}` : "landed nothing"
     ],
     ...data.retargeted.length ? [`retargeted: ${data.retargeted.map((pr) => label2(kind, pr)).join(", ")}`] : [],
     ...data.restacked.length ? [`restacked: ${data.restacked.join(", ")}`] : [],
@@ -79885,7 +80735,7 @@ async function land(argv, io) {
   unblock: ${data.stoppedAt.unblock}` : data.complete ? "stack complete" : ""
   ].filter(Boolean));
 }
-async function run15(argv, io) {
+async function run16(argv, io) {
   const [sub, ...rest] = argv.filter((arg) => arg !== "--json");
   if (sub === "plan")
     return plan(rest, io);
@@ -79895,13 +80745,13 @@ async function run15(argv, io) {
     return sync(rest, io);
   if (sub === "land")
     return land(rest, io);
-  return usage3(io, sub && !sub.startsWith("-") ? `unknown stack subcommand "${sub}"` : "missing stack subcommand", USAGE7);
+  return usage3(io, sub && !sub.startsWith("-") ? `unknown stack subcommand "${sub}"` : "missing stack subcommand", USAGE8);
 }
-var PLAN_USAGE = "workit stack plan [--name <n>] [--trunk <b> | --track <t>] [<bottom> … <top>] [--json]", STATUS_USAGE2 = "workit stack status [--name <n>] [--json]", SYNC_USAGE = "workit stack sync [--name <n>] [--local] [--dry-run] [--force <branch>]… [--json]", LAND_USAGE = "workit stack land [--name <n>] [--dry-run] [--max <n>] [--method squash|merge|rebase] [--unverified --reason <why>] [--timeout 20m] [--interval 30s] [--json]", USAGE7 = "workit stack plan|status|sync|land ... (workit help stack)", short4 = (sha) => sha ? sha.slice(0, 12) : "?", stackFailed = (io, result) => emit(io, fail(result.code, result.error, { unblock: result.unblock, data: result.data ?? {} })), label2 = (forge, pr) => pr === null ? "no PR" : `${forge === "gitlab" ? "MR !" : "PR #"}${pr}`, renderSync = (data) => [
+var PLAN_USAGE = "workit stack plan [--name <n>] [--trunk <b> | --track <t>] [<bottom> … <top>] [--json]", STATUS_USAGE2 = "workit stack status [--name <n>] [--json]", SYNC_USAGE = "workit stack sync [--name <n>] [--local] [--dry-run] [--force <branch>]… [--json]", LAND_USAGE = "workit stack land [--name <n>] [--dry-run] [--max <n>] [--method squash|merge|rebase] [--unverified --reason <why>] [--timeout 20m] [--interval 30s] [--json]", USAGE8 = "workit stack plan|status|sync|land ... (workit help stack)", short5 = (sha) => sha ? sha.slice(0, 12) : "?", stackFailed = (io, result) => emit(io, fail(result.code, result.error, { unblock: result.unblock, data: result.data ?? {} })), label2 = (forge, pr) => pr === null ? "no PR" : `${forge === "gitlab" ? "MR !" : "PR #"}${pr}`, renderSync = (data) => [
   `${data.dryRun ? "would sync" : "synced"} stack ${data.name}${data.merged.length ? `; merged: ${data.merged.map((item) => item.branch).join(", ")}` : ""}`,
   ...data.steps.map((step) => [
     `  ${step.branch} on ${step.parent}:`,
-    step.restack ? `restacked ${short4(step.restack.from)} -> ${short4(step.restack.onto)}${step.restack.head ? ` = ${short4(step.restack.head)}` : ""}${step.restack.carried === true ? " (same change; verdict carries)" : step.restack.carried === false ? " (change differs; verdict stale)" : ""}` : "up to date",
+    step.restack ? `restacked ${short5(step.restack.from)} -> ${short5(step.restack.onto)}${step.restack.head ? ` = ${short5(step.restack.head)}` : ""}${step.restack.carried === true ? " (same change; verdict carries)" : step.restack.carried === false ? " (change differs; verdict stale)" : ""}` : "up to date",
     step.push ? step.push.pushed ? `pushed${step.push.forced ? " (lease)" : ""}` : "remote current" : "",
     step.retarget ? `retargeted ${step.retarget.from} -> ${step.retarget.to}` : ""
   ].filter(Boolean).join(" "))
@@ -80064,7 +80914,7 @@ function inScope(plan, slice, file) {
 }
 function parsePlan(raw, defaults, name) {
   const problems = [];
-  if (!isRecord9(raw))
+  if (!isRecord10(raw))
     return { ok: false, problems: ["the plan must be a JSON object"] };
   const planName = name ?? (typeof raw.name === "string" ? raw.name.trim() : "");
   if (!planName || planName.length > 200 || /\p{Cc}/u.test(planName))
@@ -80087,8 +80937,8 @@ function parsePlan(raw, defaults, name) {
   const seenIds = new Set;
   const seenBranches = new Map;
   raw.slices.forEach((item, index) => {
-    const where = isRecord9(item) && typeof item.id === "string" ? `slice ${item.id}` : `slice #${index + 1}`;
-    if (!isRecord9(item)) {
+    const where = isRecord10(item) && typeof item.id === "string" ? `slice ${item.id}` : `slice #${index + 1}`;
+    if (!isRecord10(item)) {
       problems.push(`${where}: must be an object`);
       return;
     }
@@ -80406,7 +81256,7 @@ function fanoutsDir(cwd) {
   return { ok: true, data: path48.join(root.value.root, "fanouts") };
 }
 function parseStored(raw) {
-  if (!isRecord9(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
+  if (!isRecord10(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
     return null;
   if (!Array.isArray(raw.slices))
     return null;
@@ -80423,7 +81273,7 @@ function parseStored(raw) {
   });
   const slices = [];
   for (const item of raw.slices) {
-    if (!isRecord9(item) || typeof item.id !== "string" || typeof item.branch !== "string")
+    if (!isRecord10(item) || typeof item.id !== "string" || typeof item.branch !== "string")
       return null;
     slices.push({
       id: item.id,
@@ -80546,7 +81396,7 @@ function planFanout(cwd, input, now = new Date) {
     return fanoutFail("blocked", "--take-lead needs a session: WORKIT_SESSION_ID is not set", "export WORKIT_SESSION_ID=<your session id>, then plan again with --take-lead");
   if (input.takeLead && isDelegateSession(session))
     return fanoutFail("blocked", `session ${session} is a worker or verifier id; only a lead takes the lead`, "run --take-lead from the lead's own session");
-  const parsed = parsePlan(input.trunk && isRecord9(input.raw) ? { ...input.raw, trunk: input.trunk } : input.raw, {
+  const parsed = parsePlan(input.trunk && isRecord10(input.raw) ? { ...input.raw, trunk: input.trunk } : input.raw, {
     trunk: input.trunk ?? defaultTrunk(cwd),
     root: mainCheckout(cwd),
     worktreeRoot: worktreeRoot(cwd)
@@ -80669,7 +81519,7 @@ var FANOUT_VERSION = 1, TIERS, FAN_IN_MODES, fanoutFail = (code, error, unblock,
   error,
   ...unblock ? { unblock } : {},
   ...data ? { data } : {}
-}), DEFAULT_SHARED, escapeRegExp4 = (text) => text.replace(/[.+^$()|[\]\\{}*?]/gu, "\\$&"), unescape2 = (pattern) => pattern.replace(/\\(.)/gu, "$1"), hasWildcard = (pattern) => /[*?{]/u.test(pattern.replace(/\\./gu, "")), compiled, matchesAny = (patterns, file) => patterns.some((pattern) => matchesScope(pattern, file)), isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), PLACEHOLDER3, filled = (text) => text.trim() !== "" && !PLACEHOLDER3.test(text.trim()), textList = (value) => {
+}), DEFAULT_SHARED, escapeRegExp4 = (text) => text.replace(/[.+^$()|[\]\\{}*?]/gu, "\\$&"), unescape2 = (pattern) => pattern.replace(/\\(.)/gu, "$1"), hasWildcard = (pattern) => /[*?{]/u.test(pattern.replace(/\\./gu, "")), compiled, matchesAny = (patterns, file) => patterns.some((pattern) => matchesScope(pattern, file)), isRecord10 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), PLACEHOLDER4, filled = (text) => text.trim() !== "" && !PLACEHOLDER4.test(text.trim()), textList = (value) => {
   if (typeof value === "string")
     return [value];
   if (Array.isArray(value) && value.every((item) => typeof item === "string"))
@@ -80721,7 +81571,7 @@ var init_fanout = __esm(() => {
     "CHANGELOG.md"
   ];
   compiled = new Map;
-  PLACEHOLDER3 = /^(?:<[^>]*>|tbd|todo|fixme|\?+|\.\.\.|…)$/iu;
+  PLACEHOLDER4 = /^(?:<[^>]*>|tbd|todo|fixme|\?+|\.\.\.|…)$/iu;
   ID = /^[a-z0-9][a-z0-9._-]{0,63}$/u;
 });
 
@@ -81278,9 +82128,9 @@ function hasOwnCommits2(cwd, branch, start, head) {
     const onto = /^rebase(?: -i)? \(finish\): \S+ onto ([0-9a-f]+)/u.exec(subject)?.[1];
     if (!made && !(onto && !sha.startsWith(onto) && !onto.startsWith(sha)))
       continue;
-    if (sha !== head && !isAncestor3(cwd, sha, head))
+    if (sha !== head && !isAncestor4(cwd, sha, head))
       continue;
-    if (start && (sha === start || isAncestor3(cwd, sha, start)))
+    if (start && (sha === start || isAncestor4(cwd, sha, start)))
       continue;
     return true;
   }
@@ -81290,7 +82140,7 @@ function reverted(cwd, trunk, landedHead, start) {
   const fork = mergeBase(cwd, landedHead, trunk);
   if (fork && fork !== landedHead)
     return unchangedSince(cwd, fork, landedHead, trunk);
-  const before = start && start !== landedHead && isAncestor3(cwd, start, landedHead) ? start : gitRun4(cwd, ["rev-parse", "--verify", "-q", `${landedHead}^1`]).stdout.trim();
+  const before = start && start !== landedHead && isAncestor4(cwd, start, landedHead) ? start : gitRun4(cwd, ["rev-parse", "--verify", "-q", `${landedHead}^1`]).stdout.trim();
   return before ? unchangedSince(cwd, before, landedHead, trunk) : false;
 }
 function unchangedSince(cwd, before, after, trunk) {
@@ -81398,9 +82248,9 @@ function detectLanding(ctx, slice, input) {
           }
           return merged ? landed("pr_merged", merged) : { ...out, landed: true, how: "pr_merged" };
         }
-        if (!merged || head === merged || isAncestor3(ctx.cwd, head, merged))
+        if (!merged || head === merged || isAncestor4(ctx.cwd, head, merged))
           return landed("pr_merged", merged ?? head);
-        out.note = isAncestor3(ctx.cwd, merged, head) ? `${label} merged at ${merged.slice(0, 12)}; ${slice.branch} is ahead of it with newer commits` : `${label} merged at ${merged.slice(0, 12)}; ${slice.branch} has diverged from it (rewritten after the merge)`;
+        out.note = isAncestor4(ctx.cwd, merged, head) ? `${label} merged at ${merged.slice(0, 12)}; ${slice.branch} is ahead of it with newer commits` : `${label} merged at ${merged.slice(0, 12)}; ${slice.branch} has diverged from it (rewritten after the merge)`;
         return out;
       }
     }
@@ -81417,7 +82267,7 @@ function detectLanding(ctx, slice, input) {
   if (trunkIds.size === 0)
     return out;
   const froms = [fork];
-  if (input.parentHead && input.parentHead !== head && isAncestor3(ctx.cwd, input.parentHead, head))
+  if (input.parentHead && input.parentHead !== head && isAncestor4(ctx.cwd, input.parentHead, head))
     froms.push(input.parentHead);
   for (const from of froms) {
     const id = patchId(ctx.cwd, from, head);
@@ -81433,7 +82283,7 @@ function sliceStart(cwd, rows, fanout, slice) {
   const row = rows.findLast((candidate) => candidate.type === "fanout.worktree.created" && candidate.fanout === fanout && candidate.slice === slice.id && typeof candidate.baseSha === "string" && inSliceRun(candidate, slice));
   return row?.baseSha ?? null;
 }
-var isAncestor3 = (cwd, a, b) => gitRun4(cwd, ["merge-base", "--is-ancestor", a, b]).ok, TRUNK_SCAN = 500;
+var isAncestor4 = (cwd, a, b) => gitRun4(cwd, ["merge-base", "--is-ancestor", a, b]).ok, TRUNK_SCAN = 500;
 var init_fanout_landed = __esm(() => {
   init_rev();
   init_fanout();
@@ -81490,7 +82340,7 @@ function checkFanout(cwd, plan, options = {}) {
       const b = tips.get(second);
       if (landings.get(first)?.landed || landings.get(second)?.landed)
         continue;
-      if (!a || !b || isAncestor4(cwd, a, b) || isAncestor4(cwd, b, a))
+      if (!a || !b || isAncestor5(cwd, a, b) || isAncestor5(cwd, b, a))
         continue;
       const check = checks.get(second);
       const theirs = new Map((changedBy.get(first) ?? []).map((file) => [file.toLowerCase(), file]));
@@ -81670,7 +82520,7 @@ function unblockFor(check, plan) {
     return `unblock ${check.waitsFor.join(", ")} first`;
   return check.reasons[0] ?? "workit fanout check";
 }
-var SAFE = (value) => Boolean(value) && !value?.startsWith("-"), isAncestor4 = (cwd, a, b) => gitRun4(cwd, ["merge-base", "--is-ancestor", a, b]).ok, resolves = (cwd, ref) => gitRun4(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]).ok, blank2 = (slice, head) => ({
+var SAFE = (value) => Boolean(value) && !value?.startsWith("-"), isAncestor5 = (cwd, a, b) => gitRun4(cwd, ["merge-base", "--is-ancestor", a, b]).ok, resolves = (cwd, ref) => gitRun4(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]).ok, blank2 = (slice, head) => ({
   id: slice.id,
   branch: slice.branch,
   head,
@@ -81887,7 +82737,7 @@ var init_fanout_status = __esm(() => {
 // packages/workit-cli/src/verbs/fanout.ts
 var exports_fanout = {};
 __export(exports_fanout, {
-  run: () => run16
+  run: () => run17
 });
 import fs27 from "node:fs";
 import path50 from "node:path";
@@ -82083,7 +82933,7 @@ function worktree(argv, io) {
       return failed(io, result);
     return emit(io, ok(result.data), (data) => [
       `${data.created ? "created" : "kept"} worktree for slice ${data.slice} (${data.mode}): ${data.path}`,
-      `  branch ${data.branch} <- ${data.base} at ${short5(data.head)}`,
+      `  branch ${data.branch} <- ${data.base} at ${short6(data.head)}`,
       `  scratch ${data.scratch}  (put it in the worker brief: temp files go here)`,
       ...data.notes.map((note) => `note: ${note}`)
     ]);
@@ -82107,7 +82957,7 @@ function worktree(argv, io) {
     ...data.notes.map((note) => `note: ${note}`)
   ]);
 }
-async function run16(argv, io) {
+async function run17(argv, io) {
   const [sub, ...rest] = argv.filter((arg) => arg !== "--json");
   if (sub === "plan")
     return plan2(rest, io);
@@ -82119,9 +82969,9 @@ async function run16(argv, io) {
     return status3(rest, io);
   if (sub === "worktree")
     return worktree(rest, io);
-  return usage3(io, sub && !sub.startsWith("-") ? `unknown fanout subcommand "${sub}"` : "missing fanout subcommand", USAGE8);
+  return usage3(io, sub && !sub.startsWith("-") ? `unknown fanout subcommand "${sub}"` : "missing fanout subcommand", USAGE9);
 }
-var PLAN_USAGE2 = "workit fanout plan <plan.json> [--name <n>] [--trunk <b> | --track <t>] [--take-lead] [--json]", BRIEF_USAGE = "workit fanout brief <slice> [--name <n>] [--mode new|resume] [--attempt <n>] [--json]", CHECK_USAGE = "workit fanout check [<slice>…] [--name <n>] [--base <ref>] [--offline] [--json]", STATUS_USAGE3 = "workit fanout status [--name <n>] [--stuck-after 30m] [--offline] [--json]", WORKTREE_USAGE = "workit fanout worktree create <slice> [--name <n>] | worktree release <slice> [--name <n>] [--force] [--json]", USAGE8 = "workit fanout plan|brief|check|status|worktree ... (workit help fanout)", failed = (io, result) => emit(io, fail(result.code, result.error, { unblock: result.unblock, data: result.data ?? {} })), renderCheck = (data) => [
+var PLAN_USAGE2 = "workit fanout plan <plan.json> [--name <n>] [--trunk <b> | --track <t>] [--take-lead] [--json]", BRIEF_USAGE = "workit fanout brief <slice> [--name <n>] [--mode new|resume] [--attempt <n>] [--json]", CHECK_USAGE = "workit fanout check [<slice>…] [--name <n>] [--base <ref>] [--offline] [--json]", STATUS_USAGE3 = "workit fanout status [--name <n>] [--stuck-after 30m] [--offline] [--json]", WORKTREE_USAGE = "workit fanout worktree create <slice> [--name <n>] | worktree release <slice> [--name <n>] [--force] [--json]", USAGE9 = "workit fanout plan|brief|check|status|worktree ... (workit help fanout)", failed = (io, result) => emit(io, fail(result.code, result.error, { unblock: result.unblock, data: result.data ?? {} })), renderCheck = (data) => [
   `fanout ${data.name} against ${data.trunkRef}: ${data.ready ? "ready to land" : "blocked"}`,
   ...data.slices.map((slice) => slice.status === "landed" ? `  -- ${slice.id} (${slice.branch}) landed (${slice.landed?.how}${slice.landed?.pr ? ` #${slice.landed.pr}` : ""})` : `  ${slice.status === "ready" ? "ok " : "x  "}${slice.id} (${slice.branch}) ${slice.changed} file${slice.changed === 1 ? "" : "s"} · verdict ${slice.verdict.accepted ? "accepted" : slice.verdict.basis}${slice.reasons.length ? `
       ${slice.reasons.join(`
@@ -82131,7 +82981,7 @@ var PLAN_USAGE2 = "workit fanout plan <plan.json> [--name <n>] [--trunk <b> | --
   `landing order: ${data.landingOrder.join(", ")}`,
   `next: ${data.next}`,
   ...data.notes.map((note) => `note: ${note}`)
-], short5 = (sha) => sha ? sha.slice(0, 7) : "-", renderStatus2 = (data) => {
+], short6 = (sha) => sha ? sha.slice(0, 7) : "-", renderStatus2 = (data) => {
   const counts = new Map;
   for (const slice of data.slices)
     counts.set(slice.state, (counts.get(slice.state) ?? 0) + 1);
@@ -82139,7 +82989,7 @@ var PLAN_USAGE2 = "workit fanout plan <plan.json> [--name <n>] [--trunk <b> | --
     `fanout ${data.name} on ${data.trunk}: ${[...counts].map(([state, count]) => `${count} ${state.replace("_", " ")}`).join(", ")} · forge ${data.forge.available ? "on" : "off"}`,
     ...data.slices.map((slice) => {
       const parts = [
-        slice.branchExists ? short5(slice.head) : "no branch",
+        slice.branchExists ? short6(slice.head) : "no branch",
         slice.lastCommitAt && slice.idleMinutes !== null ? `idle ${slice.idleMinutes} min` : null,
         slice.pr ? `PR #${slice.pr.number} ${slice.pr.state}` : null,
         slice.ci === "unknown" ? null : `CI ${slice.ci}`,
@@ -82173,7 +83023,7 @@ var init_fanout2 = __esm(() => {
 // packages/workit-cli/src/verbs/ledger.ts
 var exports_ledger = {};
 __export(exports_ledger, {
-  run: () => run17
+  run: () => run18
 });
 import { randomBytes as randomBytes5 } from "node:crypto";
 import { parseArgs } from "node:util";
@@ -82197,7 +83047,7 @@ function targetBranch(io, rows, branch, pr) {
   }
   return { ok: true, value: branch ?? null };
 }
-async function run17(argv, io) {
+async function run18(argv, io) {
   let parsed;
   try {
     parsed = parseArgs({ args: argv, options: OPTIONS, allowPositionals: true, strict: true });
@@ -82389,7 +83239,7 @@ async function standing(io, values, args) {
     return usage4(io, `unexpected argument: ${rest[1]}`);
   return fromResult(io, clearStanding(context, { fanout, lead, leads, target: rest[0] ?? null }), (row) => row.target ? `cleared standing order ${row.target} for fanout ${fanout}` : `cleared every standing order for fanout ${fanout}`);
 }
-var USAGE9 = "workit ledger decision|ruling|verdict|standing|list|check ... (workit help ledger for the grammar)", STANDING_USAGE = 'workit ledger standing add "<order>" | list | clear [<id>]  [--fanout <name>] [--json]', OPTIONS, SESSION_SAFE2, ROLE_SAFE, actorFor = (io, values) => {
+var USAGE10 = "workit ledger decision|ruling|verdict|standing|list|check ... (workit help ledger for the grammar)", STANDING_USAGE = 'workit ledger standing add "<order>" | list | clear [<id>]  [--fanout <name>] [--json]', OPTIONS, SESSION_SAFE2, ROLE_SAFE, actorFor = (io, values) => {
   const actor = actorFromEnv(io.env);
   if (values.session !== undefined && values.as !== undefined)
     return new Error("pass --session or --as, not both");
@@ -82414,7 +83264,7 @@ var USAGE9 = "workit ledger decision|ruling|verdict|standing|list|check ... (wor
     return;
   const parsed = Number(value);
   return Number.isInteger(parsed) && parsed > 0 ? parsed : new Error(`${flag} must be a positive integer`);
-}, failed2 = (io, result) => emit(io, fail(result.code, result.error, result.unblock ? { unblock: result.unblock } : {})), fromResult = (io, result, human) => result.ok ? emit(io, ok(result.value), human) : failed2(io, result), usage4 = (io, error) => emit(io, fail("invalid_input", error, { unblock: USAGE9 })), passedTestOn = (cwd, verdict) => {
+}, failed2 = (io, result) => emit(io, fail(result.code, result.error, result.unblock ? { unblock: result.unblock } : {})), fromResult = (io, result, human) => result.ok ? emit(io, ok(result.value), human) : failed2(io, result), usage4 = (io, error) => emit(io, fail("invalid_input", error, { unblock: USAGE10 })), passedTestOn = (cwd, verdict) => {
   const ledger = readLedger(cwd);
   return ledger.ok && ledger.value.rows.some((row) => row.type === "check" && row.observer === "workit_cli" && row.name === "test" && row.result === "passed" && row.dirty !== true && row.branch === verdict.branch && row.head === verdict.head);
 }, verdictLines = (check) => {
@@ -98793,7 +99643,7 @@ async function runMutation(options) {
     if (!runnable.includes(mutant))
       record({ ...mutant, status: "no-tests", durationMs: 0, tests: [] });
   if (runnable.length === 0)
-    return finish2(options, 0, results, counts, started);
+    return finish3(options, 0, results, counts, started);
   removeStaleCopies();
   const { dir: copyDir, tree: copy } = copyWorkingTree(repo);
   const copyCwd = path53.join(copy, cwdRelative);
@@ -98857,7 +99707,7 @@ async function runMutation(options) {
         restore();
       }
     }
-    return finish2(options, baseline.durationMs, results, counts, started);
+    return finish3(options, baseline.durationMs, results, counts, started);
   } finally {
     process.off("SIGINT", onSignal);
     process.off("SIGTERM", onSignal);
@@ -98865,7 +99715,7 @@ async function runMutation(options) {
     cleanup();
   }
 }
-function finish2(options, baselineMs, results, counts, started) {
+function finish3(options, baselineMs, results, counts, started) {
   const decided = counts.killed + counts.timeout + counts.survived;
   return {
     base: options.base,
@@ -98935,7 +99785,7 @@ var init_mutate = __esm(() => {
 // packages/workit-cli/src/verbs/test-audit.ts
 var exports_test_audit = {};
 __export(exports_test_audit, {
-  run: () => run18
+  run: () => run19
 });
 import { existsSync as existsSync22 } from "node:fs";
 import path54 from "node:path";
@@ -99036,11 +99886,11 @@ function human(data) {
   }
   return lines;
 }
-async function run18(argv, io) {
+async function run19(argv, io) {
   const options = parse7(argv);
   if (typeof options === "string")
     return emit(io, fail("invalid_input", `${options}
-usage: ${USAGE10}`));
+usage: ${USAGE11}`));
   const top = git7(io.cwd, ["rev-parse", "--show-toplevel"]);
   const repo = top.ok ? path54.resolve(top.stdout.trim()) : null;
   const display = (file) => toPosix(path54.relative(io.cwd, file) || file);
@@ -99126,7 +99976,7 @@ usage: ${USAGE10}`));
   }
   return emit(io, ok(data), human);
 }
-var USAGE10 = "workit test-audit [paths…] [--diff [base]] [--rule <ids>] [--min-severity <level>] [--fail-on <level>] [--mutate [--test-cmd <cmd>] [--max-mutants <n>] [--budget <s>] [--timeout <s>]] [--json]", LEVELS, VALUE_FLAGS2, quote = (arg) => /^[\w./@:=+-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, "'\\''")}'`;
+var USAGE11 = "workit test-audit [paths…] [--diff [base]] [--rule <ids>] [--min-severity <level>] [--fail-on <level>] [--mutate [--test-cmd <cmd>] [--max-mutants <n>] [--budget <s>] [--timeout <s>]] [--json]", LEVELS, VALUE_FLAGS2, quote = (arg) => /^[\w./@:=+-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, "'\\''")}'`;
 var init_test_audit = __esm(() => {
   init_audit();
   init_mutate();
@@ -99147,12 +99997,12 @@ var init_test_audit = __esm(() => {
 // packages/workit-cli/src/verbs/knowledge.ts
 var exports_knowledge = {};
 __export(exports_knowledge, {
-  run: () => run19
+  run: () => run20
 });
-async function run19(argv, io) {
+async function run20(argv, io) {
   const [sub, ...rest] = argv.filter((arg) => arg !== "--json");
   if (sub !== "lint" || rest.length > 0)
-    return emit(io, fail("invalid_input", `usage: ${USAGE11}`));
+    return emit(io, fail("invalid_input", `usage: ${USAGE12}`));
   const report = lintKnowledge(checkRoot(io.cwd));
   if (report.unreadable.length > 0)
     return emit(io, fail("unavailable", `knowledge lint: cannot read ${report.unreadable.join(", ")}`, {
@@ -99169,7 +100019,7 @@ async function run19(argv, io) {
 `);
   return report.findings.length === 0 ? 0 : 1;
 }
-var USAGE11 = "workit knowledge lint [--json]";
+var USAGE12 = "workit knowledge lint [--json]";
 var init_knowledge2 = __esm(() => {
   init_check_config();
   init_knowledge();
@@ -99283,14 +100133,14 @@ var init_youtrack_writes = __esm(() => {
 // packages/workit-cli/src/verbs/youtrack.ts
 var exports_youtrack = {};
 __export(exports_youtrack, {
-  run: () => run20
+  run: () => run21
 });
 import { readFileSync as readFileSync25 } from "node:fs";
 import path55 from "node:path";
-async function run20(argv, io) {
+async function run21(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "note" && sub !== "time" && sub !== "meeting")
-    return usage3(io, `unknown subcommand "${sub ?? ""}"`, USAGE12);
+    return usage3(io, `unknown subcommand "${sub ?? ""}"`, USAGE13);
   const flags = parseFlags(rest, {
     markdown: "value",
     file: "value",
@@ -99299,18 +100149,18 @@ async function run20(argv, io) {
     date: "value"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, USAGE12);
+    return usage3(io, flags, USAGE13);
   const [issueId, extra] = flags.positionals;
   if (!issueId || !ISSUE_RE2.test(issueId))
-    return usage3(io, "an issue id like ABC-123 is required", USAGE12);
+    return usage3(io, "an issue id like ABC-123 is required", USAGE13);
   if (extra !== undefined)
-    return usage3(io, `unexpected argument ${extra}`, USAGE12);
+    return usage3(io, `unexpected argument ${extra}`, USAGE13);
   const minutes = positiveInt(flags.values.minutes, "--minutes");
   if (typeof minutes === "string")
-    return usage3(io, minutes, USAGE12);
+    return usage3(io, minutes, USAGE13);
   const date = youTrackWorkDateMs(flags.values.date ?? "auto");
   if ("error" in date)
-    return usage3(io, date.error, USAGE12);
+    return usage3(io, date.error, USAGE13);
   const dateMs = date.data.dateMs;
   const markedDay = flags.values.date !== undefined && flags.values.date !== "auto" ? { dateMs } : {};
   const root = io.cwd;
@@ -99328,24 +100178,24 @@ async function run20(argv, io) {
   };
   if (sub === "note") {
     if (Boolean(flags.values.markdown) === Boolean(flags.values.file))
-      return usage3(io, "pass exactly one of --markdown or --file", USAGE12);
+      return usage3(io, "pass exactly one of --markdown or --file", USAGE13);
     let markdown = flags.values.markdown ?? "";
     if (flags.values.file)
       try {
         markdown = readFileSync25(path55.resolve(io.cwd, flags.values.file), "utf8");
       } catch (error) {
-        return usage3(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE12);
+        return usage3(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE13);
       }
     if (!markdown.trim())
-      return usage3(io, "the note is empty", USAGE12);
+      return usage3(io, "the note is empty", USAGE13);
     const missing = step("comment", "comments", { operation: "note", issueId, markdown }, markdown, async (text) => commentResult(await postComment(issueId, text, root))) ?? (minutes ? step("time", "workItems", { operation: "note.time", issueId, markdown, minutes, ...markedDay }, "workit update", (text) => logTimeUpdate({ issueId, minutes, text, dateMs, workspace_root: root })) : null);
     if (missing)
       return emit(io, fail("unavailable", missing));
   } else {
     if (!minutes)
-      return usage3(io, `${sub} needs --minutes <n>`, USAGE12);
+      return usage3(io, `${sub} needs --minutes <n>`, USAGE13);
     if (sub === "meeting" && !flags.values.text)
-      return usage3(io, "meeting needs --text <what the meeting was>", USAGE12);
+      return usage3(io, "meeting needs --text <what the meeting was>", USAGE13);
     const text = flags.values.text ?? "";
     const missing = step(sub, "workItems", { operation: sub, issueId, minutes, text, ...markedDay }, text, (marked) => logTimeUpdate({ issueId, minutes, text: marked, dateMs, workspace_root: root }));
     if (missing)
@@ -99374,7 +100224,7 @@ async function run20(argv, io) {
     ...data.steps.flatMap((entry) => entry.note ? [`  note (${entry.step}): ${entry.note}`] : [])
   ]);
 }
-var USAGE12 = "workit youtrack note <ISSUE> (--markdown <t> | --file <p>) [--minutes <n>] [--date auto|YYYY-MM-DD] | youtrack time <ISSUE> --minutes <n> [--text <t>] [--date …] | youtrack meeting <ISSUE> --minutes <n> --text <t> [--date …]", commentResult = (value) => {
+var USAGE13 = "workit youtrack note <ISSUE> (--markdown <t> | --file <p>) [--minutes <n>] [--date auto|YYYY-MM-DD] | youtrack time <ISSUE> --minutes <n> [--text <t>] [--date …] | youtrack meeting <ISSUE> --minutes <n> --text <t> [--date …]", commentResult = (value) => {
   try {
     return { ok: true, data: unwrap2(value) };
   } catch (error) {
@@ -99398,14 +100248,14 @@ var init_youtrack2 = __esm(() => {
 // packages/workit-cli/src/verbs/changelog.ts
 var exports_changelog = {};
 __export(exports_changelog, {
-  run: () => run21
+  run: () => run22
 });
 import { readFileSync as readFileSync26 } from "node:fs";
 import path56 from "node:path";
-async function run21(argv, io) {
+async function run22(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "apply")
-    return usage3(io, `unknown subcommand "${sub ?? ""}"`, USAGE13);
+    return usage3(io, `unknown subcommand "${sub ?? ""}"`, USAGE14);
   const flags = parseFlags(rest, {
     entries: "value",
     path: "value",
@@ -99413,18 +100263,18 @@ async function run21(argv, io) {
     preview: "boolean"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, USAGE13);
+    return usage3(io, flags, USAGE14);
   if (flags.positionals.length)
-    return usage3(io, `unexpected argument ${flags.positionals[0]}`, USAGE13);
+    return usage3(io, `unexpected argument ${flags.positionals[0]}`, USAGE14);
   const normalizeOnly = flags.booleans.has("normalize-only");
   if (!normalizeOnly && !flags.values.entries)
-    return usage3(io, "pass --entries <JSON> or --normalize-only", USAGE13);
+    return usage3(io, "pass --entries <JSON> or --normalize-only", USAGE14);
   let entries;
   if (flags.values.entries)
     try {
       entries = readEntries(flags.values.entries, io.cwd);
     } catch (error) {
-      return usage3(io, `--entries is not valid JSON: ${String(error)}`, USAGE13);
+      return usage3(io, `--entries is not valid JSON: ${String(error)}`, USAGE14);
     }
   const input = {
     entries,
@@ -99446,7 +100296,7 @@ async function run21(argv, io) {
     `changelog updated: ${String(applied.path ?? "CHANGELOG.md")}`
   ]);
 }
-var USAGE13 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
+var USAGE14 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
   const text = raw === "-" ? readFileSync26(0, "utf8") : raw.startsWith("@") ? readFileSync26(path56.resolve(cwd, raw.slice(1)), "utf8") : raw;
   return JSON.parse(text);
 };
@@ -99459,12 +100309,12 @@ var init_changelog2 = __esm(() => {
 // packages/workit-cli/src/verbs/handoff.ts
 var exports_handoff = {};
 __export(exports_handoff, {
-  run: () => run22
+  run: () => run23
 });
 import { parseArgs as parseArgs2 } from "node:util";
 function human2(brief) {
   const lines = [
-    `branch: ${brief.branch ?? "(detached)"} @ ${short6(brief.head)}${brief.subject ? ` ${brief.subject}` : ""}`
+    `branch: ${brief.branch ?? "(detached)"} @ ${short7(brief.head)}${brief.subject ? ` ${brief.subject}` : ""}`
   ];
   if (brief.base)
     lines.push(`base:   ${brief.base}${brief.ahead === null ? "" : ` (ahead ${brief.ahead}, behind ${brief.behind})`}`);
@@ -99507,11 +100357,11 @@ async function resumeBrief(argv, io) {
       strict: true
     }));
   } catch (error) {
-    return emit(io, fail("invalid_input", error.message, { unblock: USAGE14 }));
+    return emit(io, fail("invalid_input", error.message, { unblock: USAGE15 }));
   }
   const last = values.last === undefined ? 10 : Number(values.last);
   if (!Number.isInteger(last) || last < 1)
-    return emit(io, fail("invalid_input", "--last must be a positive integer", { unblock: USAGE14 }));
+    return emit(io, fail("invalid_input", "--last must be a positive integer", { unblock: USAGE15 }));
   const built = buildHandoff(io.cwd, {
     last,
     note: values.note ?? null,
@@ -99529,13 +100379,13 @@ async function resumeBrief(argv, io) {
   }
   return emit(io, ok({ ...data, recorded }), human2);
 }
-async function run22(argv, io) {
+async function run23(argv, io) {
   if (!argv.some((arg) => arg === "--task" || arg.startsWith("--task=")))
     return resumeBrief(argv, io);
   await Promise.resolve().then(() => init_task());
   return runTaskCommand(["handoff", ...argv]);
 }
-var USAGE14 = "workit handoff [--note <text>] [--next <text>] [--record] [--last <n>] [--json]", short6 = (sha) => sha ? sha.slice(0, 12) : "no commit";
+var USAGE15 = "workit handoff [--note <text>] [--next <text>] [--record] [--last <n>] [--json]", short7 = (sha) => sha ? sha.slice(0, 12) : "no commit";
 var init_handoff = __esm(() => {
   init_ledger();
   init_output();
@@ -99914,6 +100764,35 @@ var VERBS = [
     ],
     load: () => Promise.resolve().then(() => (init_git2(), exports_git))
   }),
+  withSubcommands({
+    name: "release",
+    group: "delivery",
+    summary: "git-flow releases without the git-flow binary: start a local release branch, finish it (merge, tag, merge back, push, forge release), publish it only when asked",
+    subcommands: [
+      {
+        name: "start",
+        usage: "workit release start <version> [--hotfix] [--track <t>]",
+        summary: "Cut release/<version> (hotfix/<version> from production) locally; never pushes it"
+      },
+      {
+        name: "finish",
+        usage: "workit release finish [<version>] [--track <t>] [--dry-run]",
+        summary: "Merge into production, tag, merge back, delete the branch, push production, merge-back branches and the tag, publish the forge release; resumes an interrupted finish"
+      },
+      {
+        name: "publish",
+        usage: "workit release publish [<version>]",
+        summary: "Push the release branch (opt-in: others commit to it or CI runs on it)"
+      }
+    ],
+    examples: [
+      "workit release start 1.4.0",
+      'workit git commit -m "chore(release): 1.4.0" -- package.json CHANGELOG.md',
+      "workit release finish --dry-run",
+      "workit release finish"
+    ],
+    load: () => Promise.resolve().then(() => (init_release2(), exports_release))
+  }),
   withSubcommands({
     name: "verify-delivery",
     group: "delivery",