@dbx-tools/cli 0.1.112 → 0.3.2

package/dist/verify-ZnM5Gb2r.js

@@ -1,1510 +0,0 @@
-import { createRequire } from "node:module";
-import { consola } from "consola";
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { generate } from "ts-to-zod";
-import ts from "typescript";
-import { PacwichError, createFileSystemProject } from "pacwich";
-import pMemoize from "p-memoize";
-import { getWorkspaceScriptMetadata } from "pacwich/script";
-import { $ } from "bun";
-import semver from "semver";
-
-//#region packages/cli/src/project.ts
-const getProject = pMemoize(async () => {
-	const options = { packageManager: process.env.PACWICH_PACKAGE_MANAGER ?? "bun" };
-	const projectPath = readProjectPath();
-	if (projectPath) options.rootDirectory = projectPath;
-	const project = createFileSystemProject(options);
-	const shell = process.env.PACWICH_SHELL_DEFAULT;
-	if (shell) project.config.project.defaults.shell = shell;
-	return project;
-});
-/**
-* Project root pacwich reports when invoked under `pacwich run`.
-* Returns undefined when run directly (no workspace-script context), in
-* which case pacwich discovers the root from the cwd instead. A
-* {@link PacwichError} means "no metadata available" and is swallowed;
-* anything else propagates.
-*/
-function readProjectPath() {
-	try {
-		return getWorkspaceScriptMetadata("projectPath") || void 0;
-	} catch (error) {
-		if (error instanceof PacwichError) return void 0;
-		throw error;
-	}
-}
-
-//#endregion
-//#region packages/cli/src/script.ts
-/** Log `message` and exit non-zero. */
-function fail(message) {
-	consola.error(message);
-	process.exit(1);
-}
-/** Narrow an unknown thrown value to its message string. */
-function errorMessage(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-/** Split text on newlines, trimming each line and dropping blanks. */
-function nonEmptyLines(text) {
-	return text.split("\n").map((line) => line.trim()).filter(Boolean);
-}
-/**
-* Run a script across the workspaces, streaming each output chunk under
-* its workspace tag and returning the run summary. A bare identifier in
-* `script` (e.g. `build`) is run as that workspace's `package.json`
-* script; anything containing whitespace is treated as an inline shell
-* command (run through Bun's shell by default).
-*/
-async function runScript(options) {
-	const project = await getProject();
-	const inline = !/^[\w.-]+$/.test(options.script.trim()) ? typeof options.inline === "object" ? options.inline : { shell: "bun" } : void 0;
-	const { output, summary } = project.runScriptAcrossWorkspaces({
-		...options,
-		...inline ? { inline } : {}
-	});
-	for await (const { chunk, metadata } of output.text()) consola.withTag(metadata.workspace.name).log(chunk.trimEnd());
-	return summary;
-}
-
-//#endregion
-//#region packages/cli/src/shell.ts
-/**
-* Run a command, streaming live unless `quiet`. Returns trimmed captured
-* output regardless. Throws on non-zero unless `nothrow`.
-*/
-async function sh(args, opts = {}) {
-	let cmd = (opts.input !== void 0 ? $`${args} < ${new Response(opts.input)}` : $`${args}`).nothrow();
-	if (opts.quiet) cmd = cmd.quiet();
-	if (opts.cwd) cmd = cmd.cwd(opts.cwd);
-	const res = await cmd;
-	const stdout = res.stdout.toString().trim();
-	const stderr = res.stderr.toString().trim();
-	if (!opts.nothrow && res.exitCode !== 0) {
-		const detail = stderr || stdout;
-		throw new Error(`\`${args.join(" ")}\` failed (exit ${res.exitCode})${detail ? `: ${detail}` : ""}`);
-	}
-	return {
-		exitCode: res.exitCode,
-		stdout,
-		stderr
-	};
-}
-/** `bun x <args>` for one-off CLI tools (knip, syncpack, prettier, ...). */
-function bunx(args, opts = {}) {
-	return sh([
-		"bun",
-		"x",
-		...args
-	], opts);
-}
-
-//#endregion
-//#region packages/cli/src/git.ts
-/**
-* Run `git <args>`, returning trimmed output. Quiet by default since git is
-* used mostly for its stdout (rev-parse, log, diff, ...); pass `quiet: false`
-* to stream a mutating op live. Throws on non-zero unless `nothrow`.
-*/
-function git(args, opts = {}) {
-	return sh(["git", ...args], {
-		quiet: true,
-		...opts
-	});
-}
-/**
-* True when the `git` executable is resolvable on PATH. The PATH lookup
-* is stable for the process, so memoize it - callers (`isGitRepo`,
-* `requireGitRepo`, codegen's per-file ignore check) hit this repeatedly.
-*/
-let gitAvailable;
-function hasGit() {
-	return gitAvailable ??= Boolean(Bun.which("git"));
-}
-/**
-* True when `cwd` (default: the process cwd) is inside a git work tree.
-* Returns false when git isn't installed, so callers can use it as a
-* single "can I use git here?" gate.
-*/
-async function isGitRepo(cwd) {
-	if (!hasGit()) return false;
-	const { exitCode, stdout } = await git(["rev-parse", "--is-inside-work-tree"], {
-		nothrow: true,
-		quiet: true,
-		cwd
-	});
-	return exitCode === 0 && stdout === "true";
-}
-/**
-* Assert git is installed and `cwd` is inside a git repo, aborting with a
-* clear message otherwise. For commands that genuinely need version
-* control (commit, tag, push); optional callers should use {@link hasGit}
-* / {@link isGitRepo} and skip instead of failing.
-*/
-async function requireGitRepo(caller, cwd) {
-	if (!hasGit()) fail(`${caller} requires git, but no \`git\` executable was found on PATH.`);
-	if (!await isGitRepo(cwd)) fail(`${caller} must be run inside a git repository.`);
-}
-
-//#endregion
-//#region packages/cli/src/package.ts
-const root = (await getProject()).rootDirectory;
-/** A workspace package: its parsed manifest, location, and dependency edges. */
-var WorkspacePackage = class WorkspacePackage {
-	dir;
-	slug;
-	jsonPath;
-	constructor(meta, dir) {
-		this.meta = meta;
-		this.dir = dir;
-		this.slug = relative(root, dir);
-		this.jsonPath = join(dir, "package.json");
-	}
-	/** Build from a pacwich {@link Workspace}, reading its manifest. */
-	static async fromWorkspace(ws) {
-		const dir = resolve(root, ws.path);
-		return new WorkspacePackage(await Bun.file(join(dir, "package.json")).json(), dir);
-	}
-};
-/** Resolve `path` against the repo root. */
-function toAbsolute(path) {
-	return isAbsolute(path) ? path : resolve(root, path);
-}
-/** Repo-relative form of `path`, or absolute when it sits outside the root. */
-function toRelative(path) {
-	const rel = relative(root, path);
-	return rel !== "" && !rel.startsWith("..") && !rel.startsWith("/") && !rel.startsWith("\\") ? rel : resolve(path);
-}
-/** Yield every workspace `package.json` path (`includeRoot` prepends the root manifest). */
-async function* discoverPackageJsons(includeRoot = false) {
-	const project = await getProject();
-	if (includeRoot) yield resolve(root, project.rootWorkspace.path, "package.json");
-	for (const ws of project.workspaces) yield resolve(root, ws.path, "package.json");
-}
-/** Workspace packages passing `filter` (default: non-private), sorted by slug. */
-async function discoverPackages(filter = (pkg) => pkg.meta.private !== true) {
-	const project = await getProject();
-	return (await Promise.all(project.workspaces.map((ws) => WorkspacePackage.fromWorkspace(ws)))).filter(filter).sort((a, b) => a.slug.localeCompare(b.slug));
-}
-/** Write `value` as JSON, preserving the file's trailing newline to avoid format churn. */
-async function writeJson(path, value) {
-	const file = Bun.file(path);
-	const trailingNewline = await file.exists() ? (await file.text()).endsWith("\n") : true;
-	await Bun.write(path, JSON.stringify(value, null, 2) + (trailingNewline ? "\n" : ""));
-}
-
-//#endregion
-//#region packages/cli/src/codegen.ts
-const HEADER = [
-	"// AUTO-GENERATED by `dbxtools codegen` - DO NOT EDIT.",
-	"// Regenerate via `dbxtools codegen`.",
-	""
-].join("\n");
-const GENERATED_DIRNAME = "generated";
-function deriveName(path) {
-	const file = basename(path);
-	if (file === "model.d.ts" || file === "model.ts") return basename(dirname(path));
-	return file.replace(/\.d\.ts$|\.ts$/, "");
-}
-function parseInputArg(value) {
-	const eq = value.indexOf("=");
-	if (eq === -1) return {
-		source: value,
-		name: deriveName(value)
-	};
-	return {
-		source: value.slice(0, eq),
-		name: value.slice(eq + 1)
-	};
-}
-/**
-* Resolve a codegen input to an absolute path. A `node_modules/...`
-* source is searched for in each `node_modules` from the consuming
-* package up to the filesystem root, so it resolves whether the
-* dependency is nested under the package or hoisted to the workspace
-* root - the package manager's hoisting layout doesn't matter as long
-* as the consuming package declares the dependency. Any other source
-* (and the not-found fallback) is treated as repo-root-relative.
-*/
-function resolveInputSource(source, fromDir) {
-	if (source.startsWith("node_modules/")) {
-		let dir = fromDir;
-		for (;;) {
-			const candidate = resolve(dir, source);
-			if (existsSync(candidate)) return candidate;
-			const parent = dirname(dir);
-			if (parent === dir) break;
-			dir = parent;
-		}
-	}
-	return toAbsolute(source);
-}
-/**
-* Parse `entryPath` as TypeScript, drop every `import`
-* declaration, and rewrite any type reference whose root
-* identifier was introduced by one of those imports to the
-* `unknown` keyword. ts-to-zod sees a self-contained source where
-* the dropped peer modules surface as `z.unknown()` schemas.
-*
-* Two reference shapes get stubbed:
-*
-*   - `ns.X` (a `QualifiedName` in type position, or a
-*     `PropertyAccessExpression` in value position) where `ns` was
-*     introduced by `import * as ns from "..."`.
-*   - bare `X` where `X` was introduced by a default or named
-*     import (`import X from "..."`,
-*     `import { X } from "..."`, `import { Y as X } from "..."`).
-*
-* Comments and the rest of the file flow through unchanged.
-*/
-function stripImports(entryPath) {
-	const text = readFileSync(entryPath, "utf-8");
-	const sf = ts.createSourceFile(entryPath, text, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
-	const namespaceAliases = /* @__PURE__ */ new Set();
-	const importedNames = /* @__PURE__ */ new Set();
-	for (const stmt of sf.statements) {
-		if (!ts.isImportDeclaration(stmt) || !stmt.importClause) continue;
-		const c = stmt.importClause;
-		if (c.name) importedNames.add(c.name.text);
-		const nb = c.namedBindings;
-		if (!nb) continue;
-		if (ts.isNamespaceImport(nb)) namespaceAliases.add(nb.name.text);
-		else for (const el of nb.elements) importedNames.add(el.name.text);
-	}
-	const unknownType = () => ts.factory.createKeywordTypeNode(ts.SyntaxKind.UnknownKeyword);
-	const transformer = (context) => (root) => {
-		const visitor = (node) => {
-			if (ts.isImportDeclaration(node)) return void 0;
-			if (ts.isTypeReferenceNode(node)) {
-				const tn = node.typeName;
-				if (ts.isQualifiedName(tn) && ts.isIdentifier(tn.left) && namespaceAliases.has(tn.left.text)) return unknownType();
-				if (ts.isIdentifier(tn) && importedNames.has(tn.text)) return unknownType();
-			}
-			if (ts.isPropertyAccessExpression(node) && ts.isIdentifier(node.expression) && namespaceAliases.has(node.expression.text)) return node.name;
-			return ts.visitEachChild(node, visitor, context);
-		};
-		return ts.visitEachChild(root, visitor, context);
-	};
-	const result = ts.transform(sf, [transformer]);
-	const printer = ts.createPrinter({ removeComments: false });
-	const transformed = result.transformed[0] ?? sf;
-	const out = printer.printFile(transformed);
-	result.dispose();
-	return out;
-}
-/**
-* Final shaping of the source before ts-to-zod sees it:
-*
-*   1. Promote every top-level `interface` / `type` to an `export`.
-*      ts-to-zod only emits schemas for exported declarations and
-*      bails on exported types that reference non-exported ones,
-*      so private SDK shells (`AuthorizationDetails`,
-*      `CronSchedule`, ...) need to flip to exports for the
-*      generator to see them.
-*   2. Rewrite each JSDoc block so its leading prose becomes a
-*      single `@description` tag. ts-to-zod parses the tag and
-*      emits a matching `.describe(...)` call on the schema field
-*      (introspectable via `schema.description`, picked up by
-*      `z.toJSONSchema`). The original prose is dropped so we
-*      don't see the same paragraph twice (once as the comment
-*      body, once as the `@description` tag that
-*      `keepComments: true` would otherwise carry through). Other
-*      tags (`@minimum`, `@format`, ...) flow through verbatim.
-*/
-function preprocess(source) {
-	return source.replace(/^(interface|type)\s/gm, "export $1 ").replace(/\/\*\*([\s\S]*?)\*\//g, (match, body) => {
-		if (/@description\b/.test(body)) return match;
-		const lines = body.replace(/^\n/, "").split("\n").map((line) => line.replace(/^\s*\*\s?/, "").replace(/\s+$/, ""));
-		const firstTagIdx = lines.findIndex((line) => /^@\w+/.test(line));
-		const descLines = firstTagIdx === -1 ? lines : lines.slice(0, firstTagIdx);
-		const tagLines = firstTagIdx === -1 ? [] : lines.slice(firstTagIdx);
-		const description = descLines.join(" ").replace(/\s+/g, " ").trim();
-		if (!description) return match;
-		return `/**\n${[`@description ${description}`, ...tagLines].map((line) => ` * ${line}`.trimEnd()).join("\n")}\n */`;
-	});
-}
-/**
-* Take ts-to-zod's `getInferredTypes(...)` output - shaped for a
-* separate file (banner, `import { z } from "zod"`,
-* `import * as generated from "<schemas>"`, then
-* `export type X = z.infer<typeof generated.xSchema>` lines) - and
-* rewrite it for inclusion in the same file as the schemas:
-*
-*   - drop the banner and both imports (`z` is already imported,
-*     the schemas live right above)
-*   - drop the `generated.` namespace prefix from every reference
-*     so the type aliases bind to the colocated schema constants
-*/
-function inlineInferredTypes(inferredFile) {
-	return inferredFile.replace(/^\/\/ Generated by ts-to-zod\s*\n/, "").replace(/^import \{ z \} from "zod";\s*\n+/m, "").replace(/^import \* as generated from "[^"]*";\s*\n+/m, "").replace(/\bgenerated\.(\w+)/g, "$1").trim();
-}
-/**
-* Whether `git check-ignore` reports `absPath` as covered by an
-* ignore rule. One subprocess per call - cheap enough for the
-* handful of files codegen touches and avoids parsing `.gitignore`
-* patterns ourselves.
-*
-* Exit codes:
-*   - `0`: path is ignored.
-*   - `1`: path is not ignored.
-*   - anything else (e.g. `128` outside a worktree): treated as a
-*     hard error - we can't safely decide, so refuse.
-*/
-async function isGitIgnored(absPath) {
-	if (!hasGit()) fail(`cannot verify ${toRelative(absPath)} is gitignored: no \`git\` executable on PATH. codegen needs git to confirm it only overwrites files under \`generated/\`. Install git, or move the file out of \`generated/\` before regenerating.`);
-	const { exitCode } = await git([
-		"check-ignore",
-		"--quiet",
-		absPath
-	], { nothrow: true });
-	if (exitCode === 0) return true;
-	if (exitCode === 1) return false;
-	fail(`\`git check-ignore\` failed (exit ${exitCode}) for ${toRelative(absPath)}; is the workspace inside a git worktree?`);
-}
-/**
-* Refuse to clobber any file in `generated/` that exists and isn't
-* already gitignored. The gitignore is the codegen contract: every
-* file under `generated/` is owned by codegen, every file outside
-* is owned by the developer. Run before any write or delete inside
-* `generated/`.
-*/
-async function assertWritable(absPath) {
-	if (!existsSync(absPath)) return;
-	if (await isGitIgnored(absPath)) return;
-	fail(`refusing to overwrite ${toRelative(absPath)}: file exists and is not gitignored. Move it out of \`generated/\` (codegen output) or update the ignore before regenerating.`);
-}
-/**
-* Regenerate the `generated/` tree for one consumer package. The
-* package's `package.json` is read-only - the codegen `inputs`
-* list comes out, but nothing flows back. Consumers expose the
-* generated tree via a hand-written top-level `index.ts`
-* re-export.
-*/
-async function generatePackage(pkg) {
-	const config = pkg.meta.codegen;
-	if (!config?.inputs?.length) fail(`${pkg.slug}: \`codegen.inputs\` is missing or empty`);
-	const inputs = config.inputs.map(parseInputArg);
-	const generatedDir = resolve(pkg.dir, GENERATED_DIRNAME);
-	if (existsSync(generatedDir)) {
-		const glob = new Bun.Glob("**/*");
-		for await (const f of glob.scan({
-			cwd: generatedDir,
-			absolute: true,
-			onlyFiles: true,
-			dot: true
-		})) await assertWritable(f);
-	}
-	rmSync(generatedDir, {
-		recursive: true,
-		force: true
-	});
-	mkdirSync(generatedDir, { recursive: true });
-	await Bun.write(resolve(generatedDir, ".gitignore"), "*\n");
-	const indexLines = [];
-	let warnings = 0;
-	for (const input of inputs) {
-		const sourcePath = resolveInputSource(input.source, pkg.dir);
-		if (!existsSync(sourcePath)) fail(`${pkg.slug}: codegen input not found: ${input.source}`);
-		consola.log(`  ${input.name} <- ${input.source}`);
-		const { getZodSchemasFile, getInferredTypes, errors } = generate({
-			sourceText: preprocess(stripImports(sourcePath)),
-			keepComments: true
-		});
-		if (errors.length) {
-			warnings += errors.length;
-			for (const err of errors) consola.warn(`    ! ${err}`);
-		}
-		const importPath = `./${input.name}.zod.js`;
-		const schemas = getZodSchemasFile(importPath);
-		const inferred = inlineInferredTypes(getInferredTypes(importPath));
-		const content = HEADER + schemas.trimEnd() + "\n\n" + inferred + "\n";
-		await Bun.write(resolve(generatedDir, `${input.name}.zod.ts`), content);
-		indexLines.push(`export * from "./${input.name}.zod.js";`);
-	}
-	await Bun.write(resolve(generatedDir, "index.ts"), HEADER + indexLines.join("\n") + "\n");
-	consola.log(`${pkg.meta.name ?? pkg.slug}: ${inputs.length} module(s) -> ${toRelative(generatedDir)}/` + (warnings ? ` (${warnings} warning(s))` : ""));
-}
-/** Regenerate the `generated/` tree for every package declaring a `codegen` field. */
-async function codegen() {
-	const targets = (await discoverPackages(() => true)).filter((pkg) => pkg.meta.codegen);
-	if (targets.length === 0) {
-		consola.log("codegen: no workspace packages declare a `codegen` field");
-		return;
-	}
-	for (const pkg of targets) await generatePackage(pkg);
-}
-
-//#endregion
-//#region packages/cli/src/build.ts
-/** Compile every publishable package with the shared tsdown config. */
-async function build() {
-	await codegen();
-	const targets = await discoverPackages();
-	if (targets.length === 0) fail("No publishable packages found under packages/");
-	const configPath = toAbsolute("tsdown.config.ts");
-	consola.log(`=== Building ${targets.length} package(s) ===`);
-	const summary = await runScript({
-		script: `bun x --bun tsdown --config ${configPath}`,
-		workspacePatterns: targets.map((pkg) => pkg.meta.name),
-		dependencyOrder: true
-	});
-	if (!summary.allSuccess) fail(`Build failed: ${summary.scriptResults.filter((entry) => !entry.success && !entry.skipped).map((entry) => entry.metadata.workspace.name).join(", ")}`);
-	consola.log(`Built ${summary.successCount} package(s).`);
-}
-
-//#endregion
-//#region packages/cli/src/agent.ts
-/**
-* Run Codex headlessly via `ucode codex exec` for `dbxtools agent` and
-* release tooling that drafts notes programmatically.
-*/
-/** Default wall-clock budget for a Codex invocation. */
-const AGENT_DEFAULT_TIMEOUT_MS = 3e5;
-/** Whether `ucode codex --version` reports a usable Codex CLI. */
-async function agentAvailable() {
-	if (!Bun.which("ucode")) return false;
-	const result = await sh([
-		"ucode",
-		"codex",
-		"--version"
-	], {
-		nothrow: true,
-		quiet: true
-	});
-	return result.exitCode === 0 && /codex-cli\s+\S+/.test(result.stdout);
-}
-/** Whether an exit code looks like the process was killed on a timeout. */
-function agentTimedOut(exitCode) {
-	return exitCode === 143 || exitCode === 137;
-}
-/** argv for `ucode codex exec <prompt>`. */
-function agentExecArgs(prompt) {
-	return [
-		"ucode",
-		"codex",
-		"exec",
-		"--yolo",
-		prompt
-	];
-}
-/** Pull assistant prose out of `ucode codex exec` stdout. */
-function parseCodexStdout(stdout) {
-	const startIdx = stdout.lastIndexOf("✔ Starting Codex\n");
-	if (startIdx >= 0) return stdout.slice(startIdx + 17).trim();
-	const codexIdx = stdout.lastIndexOf("\ncodex\n");
-	if (codexIdx >= 0) {
-		const after = stdout.slice(codexIdx + 7);
-		const end = after.search(/\n(?:tokens used\b)/);
-		return (end < 0 ? after : after.slice(0, end)).trim();
-	}
-	return stdout.trim();
-}
-/**
-* Run `ucode codex exec` and return captured output. Throws when Codex
-* is absent or the wall-clock budget is exceeded. On a non-zero exit
-* the result is still returned so callers can use partial text.
-*/
-async function runAgent(prompt, opts = {}) {
-	if (!await agentAvailable()) throw new Error("ucode codex: CLI not available (run `ucode codex --version`)");
-	const timeoutMs = opts.timeoutMs ?? AGENT_DEFAULT_TIMEOUT_MS;
-	const args = agentExecArgs(prompt);
-	if (!(opts.capture !== false)) return {
-		text: "",
-		exitCode: await Bun.spawn(args, {
-			cwd: opts.cwd,
-			stdin: Bun.file("/dev/null"),
-			stdout: "inherit",
-			stderr: "inherit",
-			signal: AbortSignal.timeout(timeoutMs)
-		}).exited,
-		stderr: ""
-	};
-	const result = await withTimeout(sh(args, {
-		cwd: opts.cwd,
-		nothrow: true,
-		quiet: true,
-		input: ""
-	}), timeoutMs);
-	const text = parseCodexStdout(result.stdout);
-	if (text && opts.echo !== false) {
-		process.stdout.write(text);
-		process.stdout.write("\n");
-	}
-	return {
-		text,
-		exitCode: result.exitCode,
-		stderr: result.stderr.trim()
-	};
-}
-/**
-* `dbxtools agent` entry: run Codex and return a process exit code (0 on
-* success, 1 on failure or timeout).
-*/
-async function agent(opts) {
-	if (!await agentAvailable()) fail("ucode codex not available (install ucode and run `ucode codex --version`)");
-	const prompt = opts.prompt.trim();
-	if (!prompt) fail("prompt required (pass as arguments or pipe via stdin)");
-	const timeoutMs = opts.timeoutMs ?? AGENT_DEFAULT_TIMEOUT_MS;
-	consola.log(`Running ucode codex exec (timeout ${Math.round(timeoutMs / 1e3)}s)...`);
-	try {
-		const { text, exitCode, stderr } = await runAgent(prompt, {
-			timeoutMs,
-			capture: false
-		});
-		if (exitCode === 0) return 0;
-		if (agentTimedOut(exitCode)) {
-			consola.warn(`ucode codex timed out after ${Math.round(timeoutMs / 1e3)}s (exit ${exitCode})`);
-			return 1;
-		}
-		if (stderr) consola.warn(stderr);
-		consola.warn(`ucode codex exited ${exitCode}`);
-		return text ? 0 : 1;
-	} catch (err) {
-		const message = errorMessage(err);
-		if (/timed out|timeout|aborted/i.test(message)) {
-			consola.warn(`ucode codex timed out after ${Math.round(timeoutMs / 1e3)}s: ${message}`);
-			return 1;
-		}
-		fail(`ucode codex failed: ${message}`);
-	}
-}
-/** Join argv prompt parts, or read stdin when non-interactive and args are empty. */
-async function resolveAgentPrompt(promptParts) {
-	const fromArgs = promptParts.join(" ").trim();
-	if (fromArgs) return fromArgs;
-	if (process.stdin.isTTY) return "";
-	return (await Bun.stdin.text()).trim();
-}
-/** Reject when `promise` does not settle within `ms` milliseconds. */
-function withTimeout(promise, ms) {
-	return new Promise((resolve, reject) => {
-		const timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`ucode codex: timed out after ${ms}ms`)), ms);
-		promise.then((value) => {
-			clearTimeout(timer);
-			resolve(value);
-		}, (err) => {
-			clearTimeout(timer);
-			reject(err);
-		});
-	});
-}
-
-//#endregion
-//#region packages/cli/src/config.ts
-/** Read the optional `dbxtools` block from the root `package.json`. */
-async function readOverrides() {
-	return (await Bun.file(toAbsolute("package.json")).json()).dbxtools ?? {};
-}
-/**
-* Pick the npm scope shared by the publishable packages: the `@scope`
-* prefix that appears most often among their names. Returns undefined
-* when no scoped package exists.
-*/
-async function deriveScope() {
-	const counts = /* @__PURE__ */ new Map();
-	for (const pkg of await discoverPackages()) {
-		const match = /^(@[^/]+)\//.exec(pkg.meta.name ?? "");
-		if (!match) continue;
-		const scope = match[1];
-		counts.set(scope, (counts.get(scope) ?? 0) + 1);
-	}
-	let best;
-	let bestCount = 0;
-	for (const [scope, count] of counts) if (count > bestCount) {
-		best = scope;
-		bestCount = count;
-	}
-	return best;
-}
-/**
-* Parse an `owner/name` slug out of a git remote URL, supporting both
-* `git@host:owner/name.git` and `https://host/owner/name(.git)` forms.
-*/
-function parseRepoSlug(remoteUrl) {
-	const cleaned = remoteUrl.trim().replace(/\.git$/, "");
-	const match = /[:/]([^/:]+\/[^/]+)$/.exec(cleaned);
-	return match ? match[1] : null;
-}
-/** Resolve the `owner/name` slug from the `origin` remote, or null. */
-async function deriveRepo() {
-	if (!hasGit()) return null;
-	const { exitCode, stdout } = await git([
-		"remote",
-		"get-url",
-		"origin"
-	], { nothrow: true });
-	if (exitCode !== 0 || !stdout) return null;
-	return parseRepoSlug(stdout);
-}
-/**
-* Resolve toolkit config for the current repo, memoized for the
-* process. Overrides under the root `package.json` `dbxtools` key win
-* over the auto-derived defaults.
-*/
-const getDbxtoolsConfig = pMemoize(async () => {
-	const overrides = await readOverrides();
-	const scope = overrides.scope ?? await deriveScope() ?? "";
-	return {
-		scope,
-		repo: overrides.repo ?? await deriveRepo(),
-		sharedPackage: overrides.sharedPackage ?? (scope ? `${scope}/shared` : null)
-	};
-});
-
-//#endregion
-//#region packages/cli/src/create.ts
-const APPKIT_PEER_RANGE = "catalog:";
-/** Create a file (and any missing parent dirs) with the given content. */
-function write(path, content) {
-	mkdirSync(dirname(path), { recursive: true });
-	writeFileSync(path, content);
-}
-/** Scaffold a new workspace package under `packages/<slug>/`. */
-async function create(options) {
-	const { slug, plugin, shared } = options;
-	if (plugin && shared) fail("pass at most one of --plugin or --shared, not both");
-	if (!/^[a-z][a-z0-9-]*$/.test(slug)) fail(`invalid slug "${slug}" (lowercase kebab-case, must start with a letter)`);
-	const { scope, sharedPackage } = await getDbxtoolsConfig();
-	if (!scope) fail("could not determine an npm scope; set `dbxtools.scope` in the root package.json");
-	const existingPackages = await discoverPackages();
-	const publishedVersions = existingPackages.map((pkg) => pkg.meta.version).filter((version) => Boolean(version));
-	const hasSharedPkg = sharedPackage !== null && existingPackages.some((pkg) => pkg.meta.name === sharedPackage);
-	const initialVersion = publishedVersions.reduce((highest, version) => !highest || semver.gt(version, highest) ? version : highest, void 0);
-	if (!initialVersion) fail("no publishable packages with a `version` found to derive the initial version from");
-	const kind = plugin ? "plugin" : shared ? "shared" : "standard";
-	const bareSlug = kind === "plugin" ? slug.replace(/^appkit-/, "") : slug;
-	const dirSlug = kind === "plugin" ? `appkit-${bareSlug}` : slug;
-	const pkgDir = toAbsolute(`packages/${dirSlug}`);
-	if (existsSync(pkgDir)) fail(`packages/${dirSlug} already exists; aborting.`);
-	const capitalized = dirSlug.split("-").map((s) => s[0].toUpperCase() + s.slice(1));
-	const pascal = capitalized.join("");
-	const camel = pascal[0].toLowerCase() + pascal.slice(1);
-	const className = `${pascal}Plugin`;
-	const displayName = capitalized.join(" ");
-	const pkgName = `${scope}/${dirSlug}`;
-	const basePackageJson = {
-		name: pkgName,
-		version: initialVersion,
-		type: "module",
-		exports: { ".": "./src/index.ts" },
-		publishConfig: { access: "public" }
-	};
-	const sharedDep = hasSharedPkg && sharedPackage ? { dependencies: { [sharedPackage]: "workspace:*" } } : {};
-	const pluginPackageJson = {
-		...basePackageJson,
-		...sharedDep,
-		peerDependencies: { "@databricks/appkit": APPKIT_PEER_RANGE }
-	};
-	const sharedPackageJson = { ...basePackageJson };
-	const standardPackageJson = {
-		...basePackageJson,
-		...sharedDep
-	};
-	const packageJson = kind === "plugin" ? pluginPackageJson : kind === "shared" ? sharedPackageJson : standardPackageJson;
-	mkdirSync(pkgDir, { recursive: true });
-	await writeJson(resolve(pkgDir, "package.json"), packageJson);
-	if (kind === "plugin") {
-		const indexTs = `export { ${className}, ${camel} } from "./${dirSlug}.js";\n`;
-		const pluginTs = `import {
-  Plugin,
-  toPlugin,
-  type IAppRouter,
-  type PluginManifest,
-} from "@databricks/appkit";
-
-const manifest: PluginManifest<"${bareSlug}"> = {
-  name: "${bareSlug}",
-  displayName: "${displayName}",
-  description: "",
-  stability: "beta",
-  resources: {
-    required: [],
-    optional: [],
-  },
-};
-
-export class ${className} extends Plugin {
-  static manifest = manifest;
-
-  injectRoutes(router: IAppRouter): void {
-    // Add your routes here, e.g.:
-    // router.get("/", (_req, res) => {
-    //   res.json({ message: "Hello from ${dirSlug}" });
-    // });
-  }
-}
-
-export const ${camel} = toPlugin(${className});
-`;
-		write(resolve(pkgDir, "src", "index.ts"), indexTs);
-		write(resolve(pkgDir, "src", `${dirSlug}.ts`), pluginTs);
-		consola.log(`Scaffolded packages/${dirSlug}/ (plugin, npm name ${pkgName}, manifest name "${bareSlug}")`);
-	} else if (kind === "shared") {
-		const indexTs = `/**
- * ${pkgName}: a dependency-free, browser-safe wire-format contract.
- * Pure types (and browser-safe runtime, e.g. zod) only - no \`node:*\`
- * imports, even transitively - so any runtime can import it.
- */
-export * from "./protocol.js";
-`;
-		const protocolTs = `// Wire-format types for ${pkgName}. Pure types: no
-// Node-only imports, safe for browser bundles.
-//
-// Add your shared types below and re-export them from \`./index.ts\`.
-`;
-		write(resolve(pkgDir, "src", "index.ts"), indexTs);
-		write(resolve(pkgDir, "src", "protocol.ts"), protocolTs);
-		consola.log(`Scaffolded packages/${dirSlug}/ (shared, npm name ${pkgName})`);
-	} else {
-		const indexTs = `export * from "./${dirSlug}.js";\n`;
-		const sourceTs = `// Source module for ${pkgName}.
-//
-// Add your exports below and re-export them from \`./index.ts\`.
-export {};
-`;
-		write(resolve(pkgDir, "src", "index.ts"), indexTs);
-		write(resolve(pkgDir, "src", `${dirSlug}.ts`), sourceTs);
-		consola.log(`Scaffolded packages/${dirSlug}/ (standard, npm name ${pkgName})`);
-	}
-	consola.log(`Run \`bun install\` to link the workspace.`);
-}
-
-//#endregion
-//#region packages/cli/src/format.ts
-const require = createRequire(import.meta.url);
-/** Absolute path to a dependency's binary, read from its own `package.json`. */
-function resolveBin(pkg, binName) {
-	const pkgJsonPath = require.resolve(`${pkg}/package.json`);
-	const meta = require(`${pkg}/package.json`);
-	const bin = typeof meta.bin === "string" ? meta.bin : meta.bin?.[binName];
-	if (!bin) throw new Error(`${pkg} declares no "${binName}" bin`);
-	return resolve(dirname(pkgJsonPath), bin);
-}
-/**
-* Build the single glob prettier walks - a recursive `.ts`/`.tsx` match
-* rooted at each discovered package dir. One combined pattern avoids
-* prettier's per-pattern "no matching files" error when an individual
-* package happens to ship no `.tsx`. A brace alternation is only used
-* for two-plus dirs: a single-element `{dir}` brace with a slash inside
-* is left un-expanded by prettier's matcher, so the lone dir is emitted
-* bare. Returns `null` when no packages were discovered (so the caller
-* can skip prettier entirely). `() => true` keeps private workspaces
-* (e.g. a demo) that the default filter drops.
-*/
-async function sourceGlob() {
-	const dirs = (await discoverPackages(() => true)).map((pkg) => pkg.slug);
-	if (dirs.length === 0) return null;
-	return `${dirs.length === 1 ? dirs[0] : `{${dirs.join(",")}}`}/**/*.{ts,tsx}`;
-}
-/**
-* Reorder a `scripts` map so npm's lifecycle hooks sit next to their
-* base: `pre<x>` immediately before `<x>` and `post<x>` immediately
-* after. Groups are ordered by base name; the base script need not
-* exist (a lone `prebuild`/`postbuild` still sorts into the `build`
-* slot). The `pre`/`post` prefix is stripped purely by name - the same
-* heuristic npm uses.
-*/
-function reorderLifecycleScripts(scripts) {
-	const baseOf = (key) => {
-		const match = /^(?:pre|post)(.+)$/.exec(key);
-		return match ? match[1] : key;
-	};
-	const bases = [...new Set(Object.keys(scripts).map(baseOf))].sort();
-	const ordered = {};
-	for (const base of bases) for (const name of [
-		`pre${base}`,
-		base,
-		`post${base}`
-	]) if (name in scripts) ordered[name] = scripts[name];
-	return ordered;
-}
-/** syncpack + lifecycle-hook regroup + prettier across the workspace. */
-async function format() {
-	await bunx(["syncpack", "format"]);
-	const regrouped = [];
-	for await (const jsonPath of discoverPackageJsons(true)) {
-		const meta = await Bun.file(jsonPath).json();
-		const scripts = meta.scripts;
-		if (!scripts || Object.keys(scripts).length === 0) continue;
-		const ordered = reorderLifecycleScripts(scripts);
-		if (JSON.stringify(Object.keys(ordered)) === JSON.stringify(Object.keys(scripts))) continue;
-		meta.scripts = ordered;
-		await writeJson(jsonPath, meta);
-		regrouped.push(toRelative(jsonPath));
-	}
-	consola.log(regrouped.length > 0 ? `Regrouped lifecycle scripts in:\n${regrouped.join("\n")}` : "No lifecycle scripts to regroup.");
-	const sources = await sourceGlob();
-	if (!sources) {
-		consola.log("No packages to format.");
-		return;
-	}
-	const { stdout } = await sh([
-		"bun",
-		resolveBin("prettier", "prettier"),
-		"--write",
-		`--plugin=${require.resolve("prettier-plugin-organize-imports")}`,
-		sources
-	], { quiet: true });
-	const changed = stdout.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.endsWith("(unchanged)"));
-	consola.log(changed.length > 0 ? changed.join("\n") : "No files reformatted.");
-}
-
-//#endregion
-//#region packages/cli/src/release.ts
-/** SPDX license stamped onto published packages that don't set their own. */
-const DEFAULT_LICENSE = "Apache-2.0";
-/** Dependency fields whose `workspace:` sibling pins get resolved before publish. */
-const DEP_FIELDS = [
-	"dependencies",
-	"devDependencies",
-	"peerDependencies",
-	"optionalDependencies"
-];
-/** Map a `.ts` source path to its emitted `dist` `.js` / `.d.ts` pair. */
-function distFromSource(source) {
-	const stem = source.replace(/^\.\//, "").replace(/^src\//, "").replace(/\.[cm]?tsx?$/, "");
-	return {
-		js: `./dist/${stem}.js`,
-		dts: `./dist/${stem}.d.ts`
-	};
-}
-/**
-* Resolve a `workspace:` protocol specifier to a concrete range using
-* the sibling's `version`. `workspace:*` (and bare `workspace:`) pin the
-* exact version, `workspace:^` / `workspace:~` carry the caret / tilde,
-* and an explicit `workspace:<range>` keeps its range.
-*/
-function resolveWorkspaceSpec(spec, version) {
-	const range = spec.slice(10);
-	if (range === "" || range === "*") return version;
-	if (range === "^" || range === "~") return `${range}${version}`;
-	return range;
-}
-/**
-* Return a copy of `deps` with every `workspace:` sibling pin resolved
-* to the sibling's just-bumped version from `siblingVersions`.
-*
-* This is done here, deterministically from the on-disk manifests,
-* rather than left to `bun publish` (which resolves `workspace:*` from
-* the gitignored `bun.lock`): a stale lockfile would otherwise freeze a
-* sibling pin one version behind, so a consumer installs a mismatched
-* nested copy of that sibling. A sibling missing from the map (e.g. a
-* private, non-published workspace) is left untouched.
-*/
-function resolveWorkspaceDeps(deps, siblingVersions) {
-	const next = { ...deps };
-	for (const [name, spec] of Object.entries(next)) {
-		if (typeof spec !== "string" || !spec.startsWith("workspace:")) continue;
-		const version = siblingVersions.get(name);
-		if (version) next[name] = resolveWorkspaceSpec(spec, version);
-	}
-	return next;
-}
-/** Rewrite dev `bin` pointers (`./bin/foo.ts`) to built `dist` targets. */
-function stampBin(meta) {
-	const bin = meta.bin;
-	if (!bin) return meta;
-	const stampTarget = (target) => /^\.\/bin\/[^/]+\.[cm]?tsx?$/.test(target) ? target.replace(/^\.\/bin\/(.+)\.[cm]?tsx?$/, "./dist/bin/$1.js") : target;
-	if (typeof bin === "string") return {
-		...meta,
-		bin: stampTarget(bin)
-	};
-	const next = {};
-	for (const [name, target] of Object.entries(bin)) next[name] = stampTarget(target);
-	return {
-		...meta,
-		bin: next
-	};
-}
-/**
-* Return a publishable copy of `meta`: resolve `workspace:` sibling
-* pins to concrete versions (via `siblingVersions`), expand any source
-* `exports` pointer into a `{ types, default }` pair pointing at the
-* built `dist`, and fill in `main`, `types`, `files`, `license`, and
-* `type` when absent. Any field the manifest already sets is preserved.
-*/
-function stampManifest(meta, siblingVersions) {
-	const stamped = { ...meta };
-	for (const field of DEP_FIELDS) {
-		const deps = meta[field];
-		if (deps && typeof deps === "object") stamped[field] = resolveWorkspaceDeps(deps, siblingVersions);
-	}
-	const exportsMap = meta.exports;
-	let rootDist;
-	let firstDist;
-	if (exportsMap && typeof exportsMap === "object") {
-		const nextExports = {};
-		for (const [subpath, target] of Object.entries(exportsMap)) if (typeof target === "string" && /\.[cm]?tsx?$/.test(target)) {
-			const dist = distFromSource(target);
-			nextExports[subpath] = {
-				types: dist.dts,
-				default: dist.js
-			};
-			if (subpath === ".") rootDist = dist;
-			firstDist ??= dist;
-		} else if (typeof target === "string" && target.startsWith("./src/")) nextExports[subpath] = target.replace(/^\.\/src\//, "./dist/");
-		else nextExports[subpath] = target;
-		stamped.exports = nextExports;
-	}
-	const mainDist = rootDist ?? firstDist;
-	if (mainDist) {
-		stamped.main ??= mainDist.js;
-		stamped.types ??= mainDist.dts;
-	}
-	stamped.files ??= ["dist"];
-	stamped.license ??= DEFAULT_LICENSE;
-	stamped.type ??= "module";
-	if (typeof stamped.name === "string" && stamped.name.startsWith("@") && !stamped.publishConfig) stamped.publishConfig = { access: "public" };
-	return stampBin(stamped);
-}
-/**
-* Build every publishable package, then publish each with a stamped
-* (complete) `package.json`, restoring the slim source manifest after
-* each publish whether it succeeds or fails.
-*/
-async function release(opts = {}) {
-	const { dryRun = false } = opts;
-	await build();
-	const pkgs = await discoverPackages((pkg) => pkg.meta.private !== true && Boolean(pkg.meta.name));
-	const siblingVersions = /* @__PURE__ */ new Map();
-	for (const pkg of pkgs) if (pkg.meta.name && pkg.meta.version) siblingVersions.set(pkg.meta.name, pkg.meta.version);
-	consola.log(`=== ${dryRun ? "Dry-run publishing" : "Publishing"} ${pkgs.length} package(s) ===`);
-	const failures = [];
-	for (const pkg of pkgs) {
-		const original = await Bun.file(pkg.jsonPath).text();
-		const stamped = stampManifest(JSON.parse(original), siblingVersions);
-		await Bun.write(pkg.jsonPath, JSON.stringify(stamped, null, 2) + "\n");
-		try {
-			await sh([
-				"bun",
-				"publish",
-				...dryRun ? ["--dry-run"] : []
-			], { cwd: pkg.dir });
-			consola.success(`${dryRun ? "Dry-run" : "Published"} ${pkg.meta.name}`);
-		} catch (error) {
-			consola.error(`Failed to publish ${pkg.meta.name}: ${errorMessage(error)}`);
-			failures.push(pkg.meta.name);
-		} finally {
-			await Bun.write(pkg.jsonPath, original);
-		}
-	}
-	if (failures.length > 0) {
-		consola.error(`Publish failed for: ${failures.join(", ")}`);
-		process.exit(1);
-	}
-	consola.log(`${dryRun ? "Dry-run complete" : "Published"} ${pkgs.length} package(s).`);
-}
-
-//#endregion
-//#region packages/cli/src/tag.ts
-/**
-* `git rev-parse <args>`, returning trimmed stdout. Tolerant by
-* design (`nothrow`): rev-parse exits non-zero when a ref is unknown
-* (e.g. an unset `@{u}` upstream or a missing tag), and every caller
-* here treats "unknown" as an empty string rather than an error.
-*/
-async function gitRevParse(...args) {
-	return (await git(["rev-parse", ...args], { nothrow: true })).stdout;
-}
-/** `git status --porcelain` stdout (one entry per changed path). */
-async function gitStatus() {
-	return (await git(["status", "--porcelain"])).stdout;
-}
-/** `git push origin <ref>` (commit branch or tag). */
-async function gitPush(ref) {
-	await git([
-		"push",
-		"origin",
-		ref
-	]);
-}
-/** True when the caller passed a non-empty `--notes-since` value. */
-function notesSinceRequested(raw) {
-	return typeof raw === "string" && raw.trim().length > 0;
-}
-/**
-* Normalize a `--notes-since` baseline to a tag name. Accepts `v0.1.75`
-* or bare `0.1.75`.
-*/
-function normalizeNotesSinceTag(raw) {
-	const trimmed = raw.trim();
-	if (!trimmed) fail("--notes-since: value must not be empty");
-	return trimmed.startsWith("v") ? trimmed : `v${trimmed}`;
-}
-/** Resolve and verify a `--notes-since` tag exists locally. */
-async function resolveNotesSinceTag(raw) {
-	const tagName = normalizeNotesSinceTag(raw);
-	if (!await gitRevParse("--verify", `refs/tags/${tagName}`)) fail(`--notes-since: tag ${tagName} does not exist locally (fetch tags or pick another baseline)`);
-	return tagName;
-}
-/**
-* Find every publishable workspace and assert they all share the same
-* version (the changesets `fixed` policy). Returns the shared version
-* and the package list.
-*/
-async function findPublishables() {
-	const all = (await discoverPackages()).filter((pkg) => pkg.meta.name && pkg.meta.version);
-	if (all.length === 0) fail("No publishable packages found under packages/");
-	if (new Set(all.map((p) => p.meta.version)).size > 1) fail(`Publishable packages disagree on version (expected one fixed version):\n` + all.map((p) => `  ${p.meta.name}@${p.meta.version}`).join("\n"));
-	return {
-		version: all[0].meta.version,
-		pkgs: all.map((p) => ({
-			name: p.meta.name,
-			jsonPath: p.jsonPath
-		}))
-	};
-}
-/** Mutate just the `version` field of a package.json on disk. */
-async function writeVersion(jsonPath, nextVersion) {
-	const meta = await Bun.file(jsonPath).json();
-	meta.version = nextVersion;
-	await writeJson(jsonPath, meta);
-}
-/**
-* Create (or, on retry, update) the GitHub Release for `tag` with
-* `body` as its markdown description. GitHub renders the Release
-* body as markdown, unlike the bare tag annotation page which is
-* monospace plaintext.
-*
-* Silently no-ops when `gh` is not on `PATH`. Failures are logged
-* but never abort: the tag is already pushed at this point.
-*/
-async function publishGithubRelease(tag, body) {
-	if (!Bun.which("gh")) {
-		consola.log("(skipping GitHub Release: gh CLI not on PATH)");
-		return;
-	}
-	consola.log(`Publishing GitHub Release ${tag}...`);
-	const gh = async (args) => {
-		const { exitCode } = await sh(["gh", ...args], { nothrow: true });
-		return exitCode;
-	};
-	const createCode = await gh([
-		"release",
-		"create",
-		tag,
-		"--title",
-		tag,
-		"--notes",
-		body
-	]);
-	if (createCode === 0) return;
-	consola.warn(`gh release create exited ${createCode}; trying gh release edit.`);
-	const editCode = await gh([
-		"release",
-		"edit",
-		tag,
-		"--notes",
-		body
-	]);
-	if (editCode !== 0) consola.warn(`gh release edit exited ${editCode}; release may need manual creation.`);
-}
-/**
-* Conventional-commit type buckets, in the order they appear in the
-* generated notes. Each subject line is matched against these prefixes
-* (`feat:`, `fix(scope):`, `feat!:`, ...); anything unmatched lands in
-* the trailing "Other" section.
-*/
-const NOTE_SECTIONS = [
-	["Features", /^feat(\(.+\))?!?:\s*/i],
-	["Fixes", /^fix(\(.+\))?!?:\s*/i],
-	["Performance", /^perf(\(.+\))?!?:\s*/i],
-	["Refactors", /^refactor(\(.+\))?!?:\s*/i],
-	["Documentation", /^docs(\(.+\))?!?:\s*/i],
-	["Tests", /^test(\(.+\))?!?:\s*/i],
-	["Build & CI", /^(build|ci)(\(.+\))?!?:\s*/i],
-	["Chores", /^chore(\(.+\))?!?:\s*/i]
-];
-const OTHER_SECTION = "Other";
-/** Cap diff stat bytes fed to Codex so large ranges stay prompt-sized. */
-const CURSOR_PROMPT_STAT_MAX_CHARS = 12e3;
-const RELEASE_COMMIT_RE = /^chore: release v/i;
-/** `git diff --shortstat` for a revision range, trimmed. */
-async function gitRangeShortstat(range) {
-	return (await git([
-		"diff",
-		"--shortstat",
-		range
-	], { nothrow: true })).stdout.trim();
-}
-/** Trim long diff output so agent prompts stay bounded. */
-function truncateForPrompt(text, max = CURSOR_PROMPT_STAT_MAX_CHARS) {
-	if (text.length <= max) return text;
-	return `${text.slice(0, max)}\n\n... (${text.length - max} more characters truncated)`;
-}
-/**
-* Build a markdown release-notes body from the commits in
-* `<prevTag>..HEAD` (or the whole history when there's no previous
-* tag), grouped by conventional-commit type. The `chore: release
-* v<x>` commit this run creates is filtered out, and a compare link is
-* appended when the repo slug and a previous tag are both known.
-*
-* Used as the GitHub Release description (which renders markdown).
-*/
-async function releaseNotes(prevTag, tagName, repo, widenBaseline = false) {
-	const raw = (await git([
-		"log",
-		prevTag ? `${prevTag}..HEAD` : "HEAD",
-		"--no-merges",
-		"--pretty=format:%h	%s"
-	], { nothrow: true })).stdout;
-	const buckets = /* @__PURE__ */ new Map();
-	let includedCount = 0;
-	let releaseCommitCount = 0;
-	for (const line of nonEmptyLines(raw)) {
-		const tab = line.indexOf("	");
-		const hash = tab === -1 ? "" : line.slice(0, tab);
-		const subject = tab === -1 ? line : line.slice(tab + 1);
-		if (RELEASE_COMMIT_RE.test(subject)) {
-			releaseCommitCount++;
-			continue;
-		}
-		includedCount++;
-		const section = NOTE_SECTIONS.find(([, re]) => re.test(subject))?.[0] ?? OTHER_SECTION;
-		const entry = hash ? `- ${subject} (${hash})` : `- ${subject}`;
-		(buckets.get(section) ?? buckets.set(section, []).get(section)).push(entry);
-	}
-	const parts = [];
-	for (const [title] of [...NOTE_SECTIONS, [OTHER_SECTION]]) {
-		const lines = buckets.get(title);
-		if (lines?.length) parts.push(`### ${title}\n${lines.join("\n")}`);
-	}
-	let body;
-	if (parts.length > 0) body = parts.join("\n\n");
-	else if (prevTag) {
-		const stat = await gitRangeShortstat(`${prevTag}..HEAD`);
-		body = stat ? `No conventional-commit entries since ${prevTag}.\n\nChanges: ${stat}.` : "_No changes since the previous tag._";
-	} else body = "_Initial release._";
-	if (widenBaseline && prevTag && includedCount > 0 && (includedCount <= 2 || releaseCommitCount >= includedCount)) {
-		const stat = await gitRangeShortstat(`${prevTag}..HEAD`);
-		if (stat) body += `\n\n**Changes since ${prevTag}**: ${stat}`;
-	}
-	if (repo && prevTag) body += `\n\n**Full changelog**: https://github.com/${repo}/compare/${prevTag}...${tagName}`;
-	return body;
-}
-/**
-* Release-notes wrapper around {@link runAgent}. Returns `null` when
-* Codex is absent, errors, times out, or produces nothing.
-*/
-async function agentSummary(prompt, timeoutMs = AGENT_DEFAULT_TIMEOUT_MS) {
-	if (!await agentAvailable()) return null;
-	consola.log(`Running ucode codex to draft release notes (timeout ${Math.round(timeoutMs / 1e3)}s)...`);
-	try {
-		const { text, exitCode, stderr } = await runAgent(prompt, {
-			timeoutMs,
-			echo: false
-		});
-		if (exitCode === 0 && text) return text;
-		if (agentTimedOut(exitCode)) {
-			consola.warn(`ucode codex timed out after ${Math.round(timeoutMs / 1e3)}s (exit ${exitCode})${text ? "; partial output shown above" : ""}.`);
-			return text || null;
-		}
-		consola.warn(`ucode codex finished without usable notes (exit ${exitCode}${text ? ", partial output shown above" : ", empty output"}${stderr ? ", see stderr above" : ""}).`);
-		return text || null;
-	} catch (err) {
-		const message = errorMessage(err);
-		if (/timed out|timeout|aborted/i.test(message)) {
-			consola.warn(`ucode codex timed out after ${Math.round(timeoutMs / 1e3)}s: ${message}`);
-			return null;
-		}
-		consola.warn(`ucode codex failed: ${message}`);
-		return null;
-	}
-}
-/**
-* Ask Codex to write the release notes for `<prevTag>..HEAD`, feeding
-* it the commit subjects and per-file diff stat as context so it never
-* has to explore the tree. Returns `null` (caller falls back to
-* {@link releaseNotes}) when Codex is unavailable, there's nothing to
-* summarize, or the agent fails.
-*/
-async function agentReleaseNotes(prevTag, tagName, repo) {
-	if (!await agentAvailable()) return null;
-	const range = prevTag ? `${prevTag}..HEAD` : "HEAD";
-	const log = (await git([
-		"log",
-		range,
-		"--no-merges",
-		"--pretty=format:- %s"
-	], { nothrow: true })).stdout;
-	const stat = truncateForPrompt((await git([
-		"diff",
-		"--stat",
-		range
-	], { nothrow: true })).stdout || await gitRangeShortstat(range));
-	if (!log && !stat) return null;
-	const body = await agentSummary([
-		`Write release notes in Markdown for version ${tagName} of this TypeScript monorepo`,
-		prevTag ? `, covering the changes since ${prevTag}.` : ".",
-		`\n\nRules:`,
-		`\n- Output ONLY the release-notes markdown - no preamble, no surrounding code fences, do not modify any files.`,
-		`\n- Group changes under short \`###\` headings (e.g. Features, Fixes, Internal).`,
-		`\n- One concise bullet per notable change, user-facing and in the present tense.`,
-		`\n- Ignore noise: version-bump / "chore: release" commits, lockfile churn, generated output.`,
-		`\n\nCommit subjects:\n${log || "(none)"}`,
-		`\n\nFile change summary:\n${stat || "(none)"}`
-	].join(""));
-	if (!body) return null;
-	return repo && prevTag ? `${body}\n\n**Full changelog**: https://github.com/${repo}/compare/${prevTag}...${tagName}` : body;
-}
-/**
-* Build the release-notes body, preferring a Codex-written summary and
-* falling back to the deterministic commit grouping. The returned
-* `source` is just for logging which generator was used.
-*/
-async function buildNotes(prevTag, tagName, repo, aiNotes = true, widenBaseline = false) {
-	if (aiNotes && await agentAvailable()) consola.log(`Generating release notes for ${tagName} with ucode codex...`);
-	else consola.log(`Generating release notes for ${tagName} from commits...`);
-	if (aiNotes) {
-		const ai = await agentReleaseNotes(prevTag, tagName, repo);
-		if (ai) return {
-			body: ai,
-			source: "codex"
-		};
-		if (await agentAvailable()) consola.log("Falling back to commit-grouped release notes...");
-	}
-	return {
-		body: await releaseNotes(prevTag, tagName, repo, widenBaseline),
-		source: "commits"
-	};
-}
-/**
-* Version-bump every publishable workspace, commit, tag, push, create
-* the GitHub Release (with generated notes), and publish to the local
-* registry. See the file header for the full local-state policy.
-*/
-async function tag(opts = {}) {
-	const { bump = "patch", dryRun = false, publish = true, notesSince, aiNotes = true } = opts;
-	await requireGitRepo("dbxtools tag");
-	const { repo } = await getDbxtoolsConfig();
-	const { version: currentVersion, pkgs } = await findPublishables();
-	const nextVersion = semver.inc(currentVersion, bump);
-	if (!nextVersion) fail(`Cannot ${bump}-bump version "${currentVersion}" (semver.inc returned null)`);
-	const tagName = `v${nextVersion}`;
-	const branch = await gitRevParse("--abbrev-ref", "HEAD");
-	const dirty = await gitStatus();
-	let ahead = "0";
-	if (!dryRun) {
-		const upstream = await gitRevParse("--abbrev-ref", "--symbolic-full-name", "@{u}");
-		if (!upstream) fail(`Branch ${branch} has no upstream. Push the branch first so the release commit lands on a known ref.`);
-		ahead = (await git([
-			"rev-list",
-			"--count",
-			`${upstream}..HEAD`
-		])).stdout;
-	}
-	if (await gitRevParse("--verify", `refs/tags/${tagName}`)) fail(`Tag ${tagName} already exists locally. Pick a different bump.`);
-	if ((await git([
-		"ls-remote",
-		"--tags",
-		"origin",
-		`refs/tags/${tagName}`
-	])).stdout) fail(`Tag ${tagName} already exists on origin. Pick a different bump.`);
-	const latestTag = (await git([
-		"describe",
-		"--tags",
-		"--abbrev=0"
-	], { nothrow: true })).stdout || null;
-	const widenNotesBaseline = notesSinceRequested(notesSince);
-	const notesBaselineTag = widenNotesBaseline ? await resolveNotesSinceTag(notesSince) : latestTag;
-	consola.log(`Bump:    ${bump}`);
-	consola.log(`Current: ${currentVersion}`);
-	consola.log(`Next:    ${nextVersion}`);
-	consola.log(`Tag:     ${tagName}`);
-	if (widenNotesBaseline) {
-		consola.log(`Latest tag: ${latestTag ?? "(none)"}`);
-		consola.log(`Notes since: ${notesBaselineTag} (--notes-since)`);
-	} else consola.log(`Previous tag: ${notesBaselineTag ?? "(none)"}`);
-	const headSha = await gitRevParse("--short", "HEAD");
-	consola.log(`HEAD:    ${headSha} (${branch})`);
-	consola.log(`Packages:`);
-	for (const p of pkgs) consola.log(`  ${p.name}`);
-	if (dirty) {
-		consola.log(`Dirty files (will be folded into the release commit):`);
-		for (const line of nonEmptyLines(dirty)) consola.log(`  ${line}`);
-	}
-	if (ahead !== "0") consola.log(`Unpushed commits: ${ahead} (will be pushed with the release commit)`);
-	consola.log("");
-	const tagMessage = `Release ${tagName}`;
-	if (dryRun) {
-		consola.log("--dry-run: skipping write, commit, tag, and push.");
-		const preview = await buildNotes(notesBaselineTag, tagName, repo, aiNotes, widenNotesBaseline);
-		consola.log(`Release notes preview (${preview.source}):`);
-		consola.log(preview.body);
-		consola.log("");
-		if (publish) await sh([
-			"bun",
-			"run",
-			"release",
-			"--dry-run"
-		], { nothrow: true });
-		return;
-	}
-	consola.log(`Writing ${nextVersion} to ${pkgs.length} package.json file(s)...`);
-	for (const p of pkgs) await writeVersion(p.jsonPath, nextVersion);
-	consola.log(`Committing release ${tagName}...`);
-	await git(["add", "-A"]);
-	await git([
-		"commit",
-		"-m",
-		`chore: release ${tagName}`
-	]);
-	consola.log(`Pushing ${branch}...`);
-	await gitPush(branch);
-	consola.log(`Tagging HEAD as ${tagName}...`);
-	await git([
-		"tag",
-		"-a",
-		tagName,
-		"-m",
-		tagMessage
-	]);
-	consola.log(`Pushing ${tagName} to origin...`);
-	await gitPush(tagName);
-	const notes = await buildNotes(notesBaselineTag, tagName, repo, aiNotes, widenNotesBaseline);
-	consola.log(`Release notes ready (${notes.source}):`);
-	consola.log(notes.body);
-	consola.log("");
-	await publishGithubRelease(tagName, notes.body);
-	if (publish) {
-		consola.log("Refreshing bun.lock to the bumped versions before local publish...");
-		if ((await sh(["bun", "install"], { nothrow: true })).exitCode !== 0) consola.warn("bun install failed; skipping local publish so stale sibling pins aren't shipped. CI will publish from the tag.");
-		else {
-			consola.log("Publishing packages to the local registry (bun dbxtools release)...");
-			await sh([
-				"bun",
-				"run",
-				"release"
-			], { nothrow: true });
-		}
-	}
-	consola.log("");
-	consola.log(`Released ${tagName}.`);
-	if (repo) {
-		consola.log("  The Release workflow will fire on the tag push:");
-		consola.log(`  https://github.com/${repo}/actions/workflows/release.yml`);
-	} else consola.log("  The Release workflow will fire on the tag push.");
-}
-
-//#endregion
-//#region packages/cli/src/update.ts
-/** True when `version` is a release with no prerelease segment. */
-function isStableVersion(version) {
-	return semver.valid(version) !== null && semver.prerelease(version) === null;
-}
-/** Highest stable version in `versions` that satisfies `range`. */
-function latestStableInRange(versions, range) {
-	let best = null;
-	for (const version of versions) {
-		if (!isStableVersion(version)) continue;
-		if (!semver.satisfies(version, range, { includePrerelease: false })) continue;
-		if (!best || semver.gt(version, best)) best = version;
-	}
-	return best;
-}
-/** Rewrite a single range (or `latest`) to a caret pin on the latest stable match. */
-function stableCaretRange(versions, range) {
-	const trimmed = range.trim();
-	if (trimmed === "latest") return trimmed;
-	const alternatives = trimmed.split("||").map((part) => part.trim());
-	if (alternatives.length > 1) return alternatives.map((part) => {
-		const latest = latestStableInRange(versions, part);
-		return latest ? `^${latest}` : part;
-	}).join(" || ");
-	const latest = latestStableInRange(versions, trimmed);
-	return latest ? `^${latest}` : trimmed;
-}
-/** Fetch every published version of `pkg` from the registry. */
-async function npmVersions(pkg, cache) {
-	const cached = cache.get(pkg);
-	if (cached) return cached;
-	const result = await sh([
-		"npm",
-		"view",
-		pkg,
-		"versions",
-		"--json"
-	], {
-		quiet: true,
-		nothrow: true
-	});
-	if (result.exitCode !== 0) return null;
-	try {
-		const versions = JSON.parse(result.stdout);
-		cache.set(pkg, versions);
-		return versions;
-	} catch {
-		return null;
-	}
-}
-/** Refresh every root `catalog` entry to the latest stable release in-range. */
-async function updateCatalog() {
-	const project = await getProject();
-	const rootJsonPath = resolve(project.rootDirectory, project.rootWorkspace.path, "package.json");
-	const meta = await Bun.file(rootJsonPath).json();
-	const catalog = meta.catalog;
-	if (!catalog || Object.keys(catalog).length === 0) return false;
-	const versionsCache = /* @__PURE__ */ new Map();
-	const changes = [];
-	for (const [pkg, range] of Object.entries(catalog)) {
-		const versions = await npmVersions(pkg, versionsCache);
-		if (!versions) {
-			consola.warn(`Skipping catalog entry ${pkg}: could not resolve versions from npm`);
-			continue;
-		}
-		const nextRange = stableCaretRange(versions, range);
-		if (nextRange === range) continue;
-		catalog[pkg] = nextRange;
-		changes.push(`${pkg}: ${range} -> ${nextRange}`);
-	}
-	if (changes.length === 0) {
-		consola.log("Catalog entries already pinned to latest stable versions.");
-		return false;
-	}
-	meta.catalog = catalog;
-	await writeJson(rootJsonPath, meta);
-	consola.log(`Updated catalog:\n${changes.join("\n")}`);
-	return true;
-}
-/** Run `bun update` with `forwardArgs` at the repo root. */
-async function runBunUpdate(forwardArgs) {
-	const project = await getProject();
-	const rootDir = resolve(project.rootDirectory, project.rootWorkspace.path);
-	consola.log(`bun update${forwardArgs.length > 0 ? ` ${forwardArgs.join(" ")}` : ""}`);
-	await sh([
-		"bun",
-		"update",
-		...forwardArgs
-	], { cwd: rootDir });
-}
-/** Refresh catalog pins, then `bun update` at the repo root. */
-async function update(forwardArgs = []) {
-	await updateCatalog();
-	await runBunUpdate(forwardArgs);
-}
-/** Args after the `update` subcommand in `process.argv`. */
-function forwardedUpdateArgs(argv = process.argv) {
-	const start = argv.indexOf("update");
-	return start >= 0 ? argv.slice(start + 1) : [];
-}
-
-//#endregion
-//#region packages/cli/src/verify.ts
-/** Workspace verify pass (optional implicit-dependency scan). */
-async function verify(options = {}) {
-	const project = await getProject();
-	if (!options.workspaceDeps) {
-		consola.log(`verify: ${project.workspaces.length} workspace(s) OK (skipped workspace dependency scan; pass --workspace-deps to enable)`);
-		return;
-	}
-	const result = await project.verify({ strict: true });
-	for (const issue of [...result.errors, ...result.warnings]) if (issue.level === "error") consola.error(issue.message);
-	else consola.warn(issue.message);
-	if (!result.ok) fail(`verify found ${result.errors.length} undeclared workspace dependenc${result.errors.length === 1 ? "y" : "ies"}`);
-	consola.log(`verify: ${project.workspaces.length} workspace(s) OK`);
-}
-
-//#endregion
-export { git as A, codegen as C, toAbsolute as D, discoverPackages as E, nonEmptyLines as F, getProject as I, sh as M, errorMessage as N, toRelative as O, fail as P, build as S, discoverPackageJsons as T, agentAvailable as _, runBunUpdate as a, resolveAgentPrompt as b, updateCatalog as c, release as d, format as f, agent as g, AGENT_DEFAULT_TIMEOUT_MS as h, latestStableInRange as i, bunx as j, writeJson as k, notesSinceRequested as l, getDbxtoolsConfig as m, forwardedUpdateArgs as n, stableCaretRange as o, create as p, isStableVersion as r, update as s, verify as t, tag as u, agentTimedOut as v, WorkspacePackage as w, runAgent as x, parseCodexStdout as y };