@geonosis/release 1.1.0

package/dist/chunk-2JLVQK7Y.js

@@ -0,0 +1,941 @@
+// src/config.ts
+import { existsSync, readFileSync } from "fs";
+import { resolve } from "path";
+var CannotRun = class extends Error {
+};
+var DIALECTS = /* @__PURE__ */ new Set(["mikro-orm-ts", "postgres", "sqlite"]);
+var isRecord = (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+var strings = (value2, where) => {
+  if (value2 === void 0) return [];
+  if (!Array.isArray(value2) || value2.some((one) => typeof one !== "string")) {
+    throw new CannotRun(`${where} must be a list of strings`);
+  }
+  return value2;
+};
+var oneDir = (value2, index) => {
+  if (!isRecord(value2)) throw new CannotRun(`release.migrations[${index}] must be an object`);
+  const dir = value2["dir"];
+  const dialect = value2["dialect"];
+  if (typeof dir !== "string" || dir === "") {
+    throw new CannotRun(`release.migrations[${index}].dir must name a directory`);
+  }
+  if (typeof dialect !== "string" || !DIALECTS.has(dialect)) {
+    throw new CannotRun(
+      `release.migrations[${index}].dialect must be one of ${[...DIALECTS].toSorted().join(", ")}`
+    );
+  }
+  const phases = strings(value2["phases"], `release.migrations[${index}].phases`);
+  for (const phase of phases) {
+    if (phase !== "up" && phase !== "down") {
+      throw new CannotRun(`release.migrations[${index}].phases may only hold "up" and "down"`);
+    }
+  }
+  const squawk = value2["squawk"];
+  const exclude = isRecord(squawk) ? strings(squawk["exclude"], `release.migrations[${index}].squawk.exclude`) : [];
+  return {
+    dialect,
+    dir,
+    // `down()` holds the drop in every MikroORM migration in the corpus this was built from, and a
+    // down that is never run against a live database cannot narrow a schema anyone is serving.
+    phases: phases.length === 0 ? ["up"] : phases,
+    squawk: { exclude }
+  };
+};
+var EMPTY = {
+  migrations: [],
+  proof: {},
+  secrets: [],
+  steps: [],
+  workers: [],
+  wrangler: []
+};
+var parseReleaseConfig = (raw) => {
+  if (!isRecord(raw)) return EMPTY;
+  const release = raw["release"];
+  if (!isRecord(release)) return EMPTY;
+  const migrations = release["migrations"];
+  if (migrations !== void 0 && !Array.isArray(migrations)) {
+    throw new CannotRun("release.migrations must be a list");
+  }
+  const proof = release["proof"];
+  return {
+    migrations: (migrations ?? []).map(oneDir),
+    proof: isRecord(proof) ? { mustAssertVersion: proof["mustAssertVersion"] !== false } : {},
+    secrets: strings(release["secrets"], "release.secrets"),
+    steps: strings(release["steps"], "release.steps"),
+    workers: strings(release["workers"], "release.workers"),
+    wrangler: strings(release["wrangler"], "release.wrangler"),
+    wranglerEnv: typeof release["wranglerEnv"] === "string" ? release["wranglerEnv"] : void 0
+  };
+};
+var readReleaseConfig = (root) => {
+  const path = resolve(root, "geonosis.json");
+  if (!existsSync(path)) return EMPTY;
+  try {
+    return parseReleaseConfig(JSON.parse(readFileSync(path, "utf8")));
+  } catch (error) {
+    if (error instanceof CannotRun) throw error;
+    throw new CannotRun(`${path} is not readable JSON: ${error.message}`);
+  }
+};
+
+// src/wrangler.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
+var isRecord2 = (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+var parseJsonc = (source) => {
+  let out = "";
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index] ?? "";
+    if (char === '"') {
+      const start = index;
+      index += 1;
+      for (; index < source.length; index += 1) {
+        if (source[index] === "\\") {
+          index += 1;
+          continue;
+        }
+        if (source[index] === '"') break;
+      }
+      out += source.slice(start, index + 1);
+      continue;
+    }
+    if (char === "/" && source[index + 1] === "/") {
+      const end = source.indexOf("\n", index);
+      index = end === -1 ? source.length : end - 1;
+      continue;
+    }
+    if (char === "/" && source[index + 1] === "*") {
+      const end = source.indexOf("*/", index + 2);
+      index = end === -1 ? source.length : end + 1;
+      continue;
+    }
+    out += char;
+  }
+  return JSON.parse(out.replaceAll(/,(\s*[\]}])/g, "$1"));
+};
+var literal = (text) => {
+  const value2 = text.trim();
+  if (value2.startsWith('"') || value2.startsWith("'")) return value2.slice(1, -1);
+  if (value2 === "true") return true;
+  if (value2 === "false") return false;
+  const number = Number(value2);
+  return Number.isNaN(number) ? value2 : number;
+};
+var split = (text, delimiter) => {
+  const parts = [];
+  let depth = 0;
+  let quote = "";
+  let current = "";
+  for (const char of text) {
+    if (quote !== "") {
+      current += char;
+      if (char === quote) quote = "";
+      continue;
+    }
+    if (char === '"' || char === "'") quote = char;
+    if (char === "[" || char === "{") depth += 1;
+    if (char === "]" || char === "}") depth -= 1;
+    if (char === delimiter && depth === 0) {
+      parts.push(current);
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  parts.push(current);
+  return parts.filter((one) => one.trim() !== "");
+};
+var value = (text) => {
+  const trimmed = text.trim();
+  if (trimmed.startsWith("[")) return split(trimmed.slice(1, -1), ",").map(value);
+  if (trimmed.startsWith("{")) {
+    return Object.fromEntries(
+      split(trimmed.slice(1, -1), ",").map((pair) => {
+        const at = pair.indexOf("=");
+        return [pair.slice(0, at).trim(), value(pair.slice(at + 1))];
+      })
+    );
+  }
+  return literal(trimmed);
+};
+var put = (into, path, leaf) => {
+  let here = into;
+  for (const key of path.slice(0, -1)) {
+    if (!isRecord2(here[key])) here[key] = {};
+    here = here[key];
+  }
+  here[path.at(-1) ?? ""] = leaf;
+};
+var table = (into, path) => {
+  let here = into;
+  for (const key of path) {
+    if (!isRecord2(here[key])) here[key] = {};
+    here = here[key];
+  }
+  return here;
+};
+var arrayTable = (into, path) => {
+  let here = into;
+  for (const key of path.slice(0, -1)) {
+    if (!isRecord2(here[key])) here[key] = {};
+    here = here[key];
+  }
+  const last = path.at(-1) ?? "";
+  if (!Array.isArray(here[last])) here[last] = [];
+  const list = here[last];
+  const entry = {};
+  list.push(entry);
+  return entry;
+};
+var parseToml = (source) => {
+  const out = {};
+  let here = out;
+  const lines = source.split("\n");
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = (lines[index] ?? "").split("#")[0]?.trim() ?? "";
+    if (line === "") continue;
+    if (line.startsWith("[[") && line.endsWith("]]")) {
+      here = arrayTable(out, line.slice(2, -2).trim().split("."));
+      continue;
+    }
+    if (line.startsWith("[") && line.endsWith("]")) {
+      here = table(out, line.slice(1, -1).trim().split("."));
+      continue;
+    }
+    const at = line.indexOf("=");
+    if (at === -1) continue;
+    let text = line.slice(at + 1);
+    while ([...text].filter((one) => one === "[").length > [...text].filter((one) => one === "]").length) {
+      index += 1;
+      if (index >= lines.length) throw new CannotRun("an unterminated array in the TOML config");
+      text += `
+${(lines[index] ?? "").split("#")[0] ?? ""}`;
+    }
+    put(here, line.slice(0, at).trim().split("."), value(text));
+  }
+  return out;
+};
+var BINDING_LISTS = [
+  "ai",
+  "analytics_engine_datasets",
+  "browser",
+  "d1_databases",
+  "dispatch_namespaces",
+  "durable_objects",
+  "hyperdrive",
+  "kv_namespaces",
+  "mtls_certificates",
+  "queues",
+  "r2_buckets",
+  "send_email",
+  "services",
+  "vectorize",
+  "version_metadata",
+  "workflows"
+];
+var bindingsOf = (found) => {
+  if (Array.isArray(found)) return found.flatMap(bindingsOf);
+  if (!isRecord2(found)) return [];
+  const named = found["binding"] ?? found["name"];
+  const here = typeof named === "string" ? [named] : [];
+  const nested = Object.entries(found).filter(([key]) => key === "bindings" || key === "producers" || key === "consumers").flatMap(([, one]) => bindingsOf(one));
+  return [...here, ...nested];
+};
+var declaredIn = (config) => {
+  const triggers = config["triggers"];
+  const crons = isRecord2(triggers) && Array.isArray(triggers["crons"]) ? triggers["crons"] : [];
+  const routes = config["routes"];
+  const one = config["route"];
+  const listed = [
+    ...Array.isArray(routes) ? routes : [],
+    ...typeof one === "string" ? [one] : []
+  ];
+  return {
+    bindings: BINDING_LISTS.flatMap((key) => bindingsOf(config[key])).toSorted(),
+    crons: crons.filter((cron) => typeof cron === "string").toSorted(),
+    routes: listed.map((route) => isRecord2(route) ? route["pattern"] : route).filter((pattern) => typeof pattern === "string").toSorted()
+  };
+};
+var readWrangler = (root, relative, env) => {
+  const path = resolve2(root, relative);
+  let parsed;
+  try {
+    const source = readFileSync2(path, "utf8");
+    parsed = relative.endsWith(".toml") ? parseToml(source) : parseJsonc(source);
+  } catch (error) {
+    throw new CannotRun(`${relative} could not be read: ${error.message}`);
+  }
+  if (!isRecord2(parsed)) throw new CannotRun(`${relative} is not a wrangler configuration`);
+  const environments = parsed["env"];
+  const block = env !== void 0 && isRecord2(environments) && isRecord2(environments[env]) ? environments[env] : parsed;
+  return declaredIn(block);
+};
+
+// src/deployed.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve3 } from "path";
+var DEPLOYED_FILE = ".geonosis/deployed.json";
+var NOTHING_SAYS = "nothing here says what is deployed \u2014 .geonosis/deployed.json is written by the pipeline after promote, and its absence is not a pass";
+var listOf = (found) => Array.isArray(found) ? found.filter((one) => typeof one === "string") : [];
+var isRecord3 = (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+var readDeployed = (root) => {
+  const path = resolve3(root, DEPLOYED_FILE);
+  if (!existsSync2(path)) throw new CannotRun(NOTHING_SAYS);
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync3(path, "utf8"));
+  } catch (error) {
+    throw new CannotRun(`${DEPLOYED_FILE} is not readable JSON: ${error.message}`);
+  }
+  if (!isRecord3(parsed)) throw new CannotRun(`${DEPLOYED_FILE} is not an object`);
+  const triggers = isRecord3(parsed["triggers"]) ? parsed["triggers"] : {};
+  return {
+    ...typeof parsed["at"] === "string" ? { at: parsed["at"] } : {},
+    deployed: {
+      bindings: listOf(parsed["bindings"]),
+      crons: listOf(triggers["crons"]),
+      routes: listOf(triggers["routes"]),
+      secrets: listOf(parsed["secrets"])
+    }
+  };
+};
+var missingBetween = (kind, declared, deployed) => {
+  const missing = declared.filter((one) => !deployed.includes(one));
+  const extra = deployed.filter((one) => !declared.includes(one));
+  return missing.length === 0 && extra.length === 0 ? [] : [{ extra, kind, missing }];
+};
+var driftBetween = (declared, deployed) => [
+  ...missingBetween("crons", declared.crons, deployed.crons),
+  ...missingBetween("routes", declared.routes, deployed.routes),
+  ...missingBetween("bindings", declared.bindings, deployed.bindings),
+  ...missingBetween("secrets", declared.secrets, deployed.secrets)
+];
+var runDeployed = (input) => {
+  const config = readReleaseConfig(input.root);
+  const configs = config.wrangler ?? [];
+  const secrets = config.secrets ?? [];
+  if (configs.length === 0 && secrets.length === 0) {
+    throw new CannotRun(
+      "geonosis.json names no release.wrangler configs and no release.secrets \u2014 nothing here declares what a deployment is supposed to carry"
+    );
+  }
+  const found = configs.map((one) => readWrangler(input.root, one, config.wranglerEnv));
+  const declared = {
+    bindings: [...new Set(found.flatMap((one) => one.bindings))].toSorted(),
+    crons: [...new Set(found.flatMap((one) => one.crons))].toSorted(),
+    routes: [...new Set(found.flatMap((one) => one.routes))].toSorted(),
+    secrets: [...secrets].toSorted()
+  };
+  const { at, deployed } = readDeployed(input.root);
+  const drift = driftBetween(declared, deployed);
+  return { ...at === void 0 ? {} : { at }, drift, ok: drift.length === 0 };
+};
+var formatDeployed = (report) => {
+  if (report.ok) {
+    return `OK    deployed: what the tree declares is what the pipeline reported${report.at === void 0 ? "" : ` at ${report.at}`}
+`;
+  }
+  return report.drift.flatMap((one) => [
+    ...one.missing.length === 0 ? [] : [`  declared but not deployed  ${one.kind}: ${one.missing.join(", ")}
+`],
+    ...one.extra.length === 0 ? [] : [`  deployed but not declared  ${one.kind}: ${one.extra.join(", ")}
+`]
+  ]).join("");
+};
+
+// src/added.ts
+import { execFileSync, spawnSync } from "child_process";
+var git = (root, args) => {
+  try {
+    return execFileSync("git", [...args], { cwd: root, encoding: "utf8", stdio: "pipe" });
+  } catch (error) {
+    throw new CannotRun(`git ${args.join(" ")} failed: ${(error.message ?? "").trim()}`);
+  }
+};
+var addedSince = (root, since) => git(root, ["diff", "--name-only", "--diff-filter=A", `${since}..HEAD`]).split("\n").filter((line) => line !== "");
+var gitOk = (root, args) => {
+  const run = spawnSync("git", [...args], { cwd: root, encoding: "utf8" });
+  return run.error === void 0 && run.status === 0;
+};
+
+// src/marker.ts
+var MARKER = /^[^\S\n]*(?:--|\/\/)[^\S\n]*contract-migration:[^\S\n]*(.*)$/gim;
+var SINCE = /(?:^|\s)since:(\S+)/;
+var markersIn = (source) => {
+  const out = [];
+  MARKER.lastIndex = 0;
+  for (let found = MARKER.exec(source); found !== null; found = MARKER.exec(source)) {
+    const tail = found[1] ?? "";
+    const since = SINCE.exec(tail)?.[1];
+    out.push({
+      line: source.slice(0, found.index).split("\n").length,
+      reason: (since === void 0 ? tail : tail.replace(SINCE, " ")).trim(),
+      ...since === void 0 ? {} : { since }
+    });
+  }
+  return out;
+};
+var judge = (marker, root, base) => {
+  if (marker.reason === "") {
+    return "the marker gives no reason \u2014 a marker with nothing after the colon is a comment";
+  }
+  if (marker.since === void 0) {
+    return "the marker has no since:<ref> \u2014 an expand nobody can date excuses nothing";
+  }
+  if (!gitOk(root, ["rev-parse", "--verify", "--quiet", `${marker.since}^{commit}`])) {
+    return `since:${marker.since} is a ref git does not know`;
+  }
+  if (!gitOk(root, ["merge-base", "--is-ancestor", marker.since, base])) {
+    return `since:${marker.since} is not an ancestor of ${base} \u2014 the expand it names is inside this release, so nothing has drained`;
+  }
+  return void 0;
+};
+
+// src/mikro.ts
+var Unreadable = class extends Error {
+};
+var isSpace = (char) => char === " " || char === "	" || char === "\n" || char === "\r";
+var advance = (source, at, to) => {
+  for (let index = at.index; index < to; index += 1) {
+    if (source[index] === "\n") at.line += 1;
+  }
+  at.index = to;
+};
+var skipTrivia = (source, at) => {
+  for (; ; ) {
+    while (at.index < source.length && isSpace(source[at.index] ?? "")) {
+      if (source[at.index] === "\n") at.line += 1;
+      at.index += 1;
+    }
+    if (source.startsWith("//", at.index)) {
+      const end = source.indexOf("\n", at.index);
+      advance(source, at, end === -1 ? source.length : end);
+      continue;
+    }
+    if (source.startsWith("/*", at.index)) {
+      const end = source.indexOf("*/", at.index + 2);
+      if (end === -1) throw new Unreadable("an unterminated block comment");
+      advance(source, at, end + 2);
+      continue;
+    }
+    return;
+  }
+};
+var readLiteral = (source, at) => {
+  const quote = source[at.index];
+  if (quote !== "`" && quote !== "'" && quote !== '"') {
+    throw new Unreadable(`an argument that is not a string literal: ${nameOf(source, at.index)}`);
+  }
+  let out = "";
+  let index = at.index + 1;
+  for (; index < source.length; index += 1) {
+    const char = source[index] ?? "";
+    if (char === "\\") {
+      out += source[index + 1] ?? "";
+      index += 1;
+      continue;
+    }
+    if (quote === "`" && char === "$" && source[index + 1] === "{") {
+      throw new Unreadable("a template literal with an interpolation");
+    }
+    if (char === quote) {
+      advance(source, at, index + 1);
+      return out;
+    }
+    out += char;
+  }
+  throw new Unreadable("an unterminated string literal");
+};
+var nameOf = (source, index) => {
+  const rest = source.slice(index);
+  const end = rest.search(/[),\n]/);
+  return (end === -1 ? rest : rest.slice(0, end)).trim();
+};
+var addSqlIn = (source, phases) => {
+  const out = [];
+  for (const phase of phases) {
+    const body = phaseBody(source, phase);
+    if (body === void 0) continue;
+    const at = { index: 0, line: body.line };
+    const calls = /(?:^|[^\w$.])(?:this\.)?addSql\s*\(/g;
+    for (let found = calls.exec(body.text); found !== null; found = calls.exec(body.text)) {
+      advance(body.text, at, found.index + found[0].length);
+      skipTrivia(body.text, at);
+      const line = at.line;
+      let sql = readLiteral(body.text, at);
+      for (; ; ) {
+        skipTrivia(body.text, at);
+        if (body.text[at.index] !== "+") break;
+        advance(body.text, at, at.index + 1);
+        skipTrivia(body.text, at);
+        sql += readLiteral(body.text, at);
+      }
+      out.push({ line, sql });
+      calls.lastIndex = at.index;
+    }
+  }
+  return out.toSorted((a, b) => a.line - b.line);
+};
+var phaseBody = (source, phase) => {
+  const blanked = blank(source);
+  const opener = new RegExp(`\\b${phase}\\s*\\([^)]*\\)[^{;]*\\{`);
+  const found = opener.exec(blanked);
+  if (found === null) return void 0;
+  const open = found.index + found[0].length - 1;
+  let depth = 0;
+  for (let index = open; index < blanked.length; index += 1) {
+    if (blanked[index] === "{") depth += 1;
+    if (blanked[index] === "}") {
+      depth -= 1;
+      if (depth === 0) {
+        return {
+          line: source.slice(0, open + 1).split("\n").length,
+          text: source.slice(open + 1, index)
+        };
+      }
+    }
+  }
+  throw new Unreadable(`an unbalanced ${phase}() body`);
+};
+var blank = (source) => {
+  const out = [...source];
+  const hide = (from, to) => {
+    for (let index = from; index < to && index < out.length; index += 1) {
+      if (out[index] !== "\n") out[index] = " ";
+    }
+  };
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index] ?? "";
+    if (char === "/" && source[index + 1] === "/") {
+      const end2 = source.indexOf("\n", index);
+      const stop = end2 === -1 ? source.length : end2;
+      hide(index, stop);
+      index = stop;
+      continue;
+    }
+    if (char === "/" && source[index + 1] === "*") {
+      const end2 = source.indexOf("*/", index + 2);
+      const stop = end2 === -1 ? source.length : end2 + 2;
+      hide(index, stop);
+      index = stop - 1;
+      continue;
+    }
+    if (char !== "`" && char !== "'" && char !== '"') continue;
+    let end = index + 1;
+    for (; end < source.length; end += 1) {
+      if (source[end] === "\\") {
+        end += 1;
+        continue;
+      }
+      if (source[end] === char) break;
+    }
+    hide(index + 1, end);
+    index = end;
+  }
+  return out.join("");
+};
+
+// src/sql.ts
+var NARROWING = [
+  ["DROP TABLE", /\bDROP\s+TABLE\b/i],
+  ["DROP COLUMN", /\bDROP\s+COLUMN\b/i],
+  ["RENAME", /\bRENAME\b/i],
+  ["ALTER COLUMN \u2026 TYPE", /\bALTER\s+COLUMN\b[^;]*\bTYPE\b/i],
+  ["SET NOT NULL", /\bSET\s+NOT\s+NULL\b/i]
+];
+var statementsOf = (sql) => sql.replaceAll(/'[^']*'/g, (found) => `'${found.slice(1, -1).replaceAll(/[^\n]/g, " ")}'`);
+var lineOf = (body, index) => body.slice(0, index).split("\n").length;
+var refusalsIn = (path, body, firstLine = 1) => {
+  const stripped = statementsOf(body);
+  return NARROWING.flatMap(([verb, pattern]) => {
+    const found = pattern.exec(stripped);
+    return found === null ? [] : [{ line: lineOf(stripped, found.index) + firstLine - 1, path, verb }];
+  });
+};
+
+// src/migrations.ts
+import { mkdtempSync, readFileSync as readFileSync4, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { basename, join, resolve as resolve5 } from "path";
+
+// src/squawk.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync3 } from "fs";
+import { dirname, resolve as resolve4 } from "path";
+import { fileURLToPath } from "url";
+var HERE = dirname(fileURLToPath(import.meta.url));
+var findSquawk = (from = HERE) => {
+  for (let dir = from; ; dir = dirname(dir)) {
+    const candidate = resolve4(dir, "node_modules/.bin/squawk");
+    if (existsSync3(candidate)) return candidate;
+    if (dirname(dir) === dir) break;
+  }
+  throw new CannotRun(
+    "squawk-cli is not installed beside this package \u2014 the Postgres dialect cannot be measured, and a gate that cannot measure has not passed"
+  );
+};
+var squawkOn = (input) => {
+  const { cwd, exclude, files } = input;
+  if (files.length === 0) return { findings: "", ok: true };
+  const run = spawnSync2(
+    input.bin ?? findSquawk(),
+    [...exclude.length === 0 ? [] : [`--exclude=${exclude.join(",")}`], ...files],
+    { cwd, encoding: "utf8" }
+  );
+  if (run.error !== void 0) {
+    throw new CannotRun(`squawk could not be started: ${run.error.message}`);
+  }
+  const findings = `${run.stdout}${run.stderr}`;
+  if (run.status === 0) return { findings, ok: true };
+  if (run.status === 1) return { findings, ok: false };
+  throw new CannotRun(
+    `squawk exited ${String(run.status)}, which is neither clean nor findings:
+${findings}`
+  );
+};
+
+// src/migrations.ts
+var EXTENSION = {
+  "mikro-orm-ts": ".ts",
+  postgres: ".sql",
+  sqlite: ".sql"
+};
+var under = (dir, file) => file === dir || file.startsWith(dir.endsWith("/") ? dir : `${dir}/`);
+var fromTypeScript = (path, source, entry) => {
+  try {
+    return addSqlIn(source, entry.phases ?? ["up"]).flatMap(
+      (one) => refusalsIn(path, one.sql, one.line)
+    );
+  } catch (error) {
+    if (error instanceof Unreadable) {
+      throw new CannotRun(`${path} holds ${error.message} \u2014 this reader cannot read it`);
+    }
+    throw error;
+  }
+};
+var sqlFor = (path, source, entry) => entry.dialect === "mikro-orm-ts" ? addSqlIn(source, entry.phases ?? ["up"]).map((one) => one.sql.trim()).map((one) => one.endsWith(";") ? one : `${one};`).join("\n") : source;
+var runMigrations = (input) => {
+  const config = readReleaseConfig(input.root);
+  const declared = config.migrations ?? [];
+  if (declared.length === 0) {
+    throw new CannotRun(
+      "geonosis.json names no release.migrations \u2014 nothing here says which directories hold migrations, or in which dialect"
+    );
+  }
+  const entries = input.dialect === void 0 ? declared : declared.filter((one) => one.dialect === input.dialect);
+  if (entries.length === 0) {
+    throw new CannotRun(`release.migrations names no directory with dialect "${input.dialect}"`);
+  }
+  const matched = addedSince(input.root, input.since).flatMap((file) => {
+    const entry = entries.find(
+      (one) => under(one.dir, file) && file.endsWith(EXTENSION[one.dialect])
+    );
+    return entry === void 0 ? [] : [{ entry, file }];
+  });
+  const refusals = [];
+  const markers = [];
+  const squawk = [];
+  const forSquawk = [];
+  for (const { entry, file } of matched) {
+    const source = readFileSync4(resolve5(input.root, file), "utf8");
+    const found = markersIn(source);
+    const bad = found.flatMap((one) => {
+      const why = judge(one, input.root, input.since);
+      return why === void 0 ? [] : [{ line: one.line, path: file, why }];
+    });
+    markers.push(...bad);
+    const excused = found.length > 0 && bad.length === 0;
+    if (!excused) {
+      refusals.push(
+        ...entry.dialect === "mikro-orm-ts" ? fromTypeScript(file, source, entry) : refusalsIn(file, source)
+      );
+    }
+    if (entry.dialect !== "sqlite")
+      forSquawk.push({ entry, file, sql: sqlFor(file, source, entry) });
+  }
+  let clean = true;
+  if (forSquawk.length > 0) {
+    const staging = mkdtempSync(join(tmpdir(), "geonosis-release-squawk-"));
+    try {
+      for (const one of forSquawk) {
+        const path = one.entry.dialect === "mikro-orm-ts" ? join(staging, `${basename(one.file, ".ts")}.sql`) : resolve5(input.root, one.file);
+        if (one.entry.dialect === "mikro-orm-ts") writeFileSync(path, `${one.sql}
+`);
+        const found = squawkOn({
+          cwd: input.root,
+          exclude: one.entry.squawk?.exclude ?? [],
+          files: [path]
+        });
+        if (!found.ok) {
+          clean = false;
+          squawk.push({ findings: found.findings, path: one.file });
+        }
+      }
+    } finally {
+      rmSync(staging, { force: true, recursive: true });
+    }
+  }
+  return {
+    linted: forSquawk.length,
+    markers: markers.toSorted((a, b) => a.path.localeCompare(b.path) || a.line - b.line),
+    ok: refusals.length === 0 && markers.length === 0 && clean,
+    read: matched.length,
+    refusals: refusals.toSorted(
+      (a, b) => a.path.localeCompare(b.path) || a.line - b.line || a.verb.localeCompare(b.verb)
+    ),
+    squawk
+  };
+};
+var WHY = `
+A release may only WIDEN the schema. Migrations run against live databases while the previous
+version is still serving, and no rollback undoes them. Contract in a later release, or say why it
+is safe now:
+
+  -- contract-migration: <what expanded it, and why nothing reads it any more> since:<ref>
+`;
+var formatMigrations = (report) => {
+  if (report.ok) {
+    return `OK    migrations: expand-only (${String(report.read)} read, ${String(report.linted)} linted by squawk)
+`;
+  }
+  const said = report.markers.map((one) => `  ${one.path}: ${one.why} (line ${String(one.line)})
+`);
+  const lines = report.refusals.map(
+    (one) => `  ${one.path}: ${one.verb} (line ${String(one.line)})
+`
+  );
+  const found = report.squawk.map((one) => `  ${one.path}:
+${one.findings}
+`);
+  const why = report.markers.length + report.refusals.length === 0 ? "" : WHY;
+  return `${said.join("")}${lines.join("")}${why}${found.join("")}`;
+};
+
+// src/plan.ts
+var STEPS = ["upload", "park", "prove", "promote"];
+var WHY_VERSION_IDENTITY = "An override that was not applied routes by the configured percentages, to the OLD version \u2014 so a smoke that does not assert which version answered can pass by testing the code it was replacing.";
+var runPlan = (input) => {
+  const config = readReleaseConfig(input.root);
+  const steps = config.steps ?? [];
+  if (steps.length === 0) {
+    throw new CannotRun(
+      "geonosis.json names no release.steps \u2014 nothing here says what this repo does to put a version in front of a user"
+    );
+  }
+  const problems = [];
+  const prove2 = steps.indexOf("prove");
+  const promote = steps.indexOf("promote");
+  if (prove2 === -1 || promote === -1 || prove2 > promote) {
+    problems.push(
+      "prove must come before promote \u2014 a promote that has not been proved serves code nothing answered for"
+    );
+  }
+  if (steps.length !== STEPS.length || steps.some((step, at) => step !== STEPS[at])) {
+    problems.push(`release.steps must be exactly ${STEPS.join(" \u2192 ")}, and is ${steps.join(" \u2192 ")}`);
+  }
+  const mustAssert = config.proof?.mustAssertVersion !== false;
+  if (!mustAssert && !input.accept) {
+    problems.push(
+      `release.proof.mustAssertVersion is false. ${WHY_VERSION_IDENTITY} Pass --i-accept-an-unproven-smoke to say so on purpose.`
+    );
+  }
+  return {
+    accepted: !mustAssert && input.accept,
+    ok: problems.length === 0,
+    problems,
+    steps: [...steps]
+  };
+};
+var formatPlan = (report) => {
+  if (!report.ok) return `${report.problems.map((one) => `  ${one}
+`).join("")}`;
+  const note = report.accepted ? `      the smoke need not say which version answered. ${WHY_VERSION_IDENTITY}
+` : "      the smoke asserts the version that answered it\n";
+  return `OK    release: ${report.steps.join(" \u2192 ")}
+${note}`;
+};
+
+// src/runner.ts
+import { spawn } from "child_process";
+var Runner = class {
+  buffered = "";
+  closed;
+  child;
+  waiting = [];
+  constructor(command, args, cwd) {
+    this.child = spawn(command, [...args], { cwd, stdio: ["pipe", "pipe", "pipe"] });
+    this.child.stdout.setEncoding("utf8");
+    this.child.stdout.on("data", (chunk) => {
+      this.buffered += chunk;
+      for (let at = this.buffered.indexOf("\n"); at !== -1; at = this.buffered.indexOf("\n")) {
+        const line = this.buffered.slice(0, at);
+        this.buffered = this.buffered.slice(at + 1);
+        this.waiting.shift()?.(line);
+      }
+    });
+    this.child.on("error", (error) => {
+      this.closed = error.message;
+    });
+    this.child.on("close", () => {
+      this.closed ??= "the runner exited without answering";
+    });
+  }
+  async ask(request, timeoutMs = 6e4) {
+    if (this.closed !== void 0) {
+      throw new CannotRun(`the runner is gone before "${request.step}": ${this.closed}`);
+    }
+    const line = await new Promise((resolve6, reject) => {
+      const timer = setTimeout(() => {
+        reject(
+          new CannotRun(
+            `the runner did not answer "${request.step}" within ${String(timeoutMs)}ms`
+          )
+        );
+      }, timeoutMs);
+      this.waiting.push((answer) => {
+        clearTimeout(timer);
+        resolve6(answer);
+      });
+      this.child.on("close", () => {
+        clearTimeout(timer);
+        reject(new CannotRun(`the runner closed before answering "${request.step}"`));
+      });
+      this.child.stdin.write(`${JSON.stringify(request)}
+`);
+    });
+    try {
+      return JSON.parse(line);
+    } catch {
+      throw new CannotRun(
+        `the runner answered "${request.step}" with something that is not JSON: ${line}`
+      );
+    }
+  }
+  close() {
+    this.child.stdin.end();
+    this.child.kill();
+  }
+};
+
+// src/prove.ts
+import { existsSync as existsSync4 } from "fs";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var stringAt = (reply, key) => typeof reply[key] === "string" ? reply[key] : void 0;
+var proveOver = async (input) => {
+  const runner = new Runner(input.command, input.args ?? [], input.cwd);
+  const steps = [];
+  const refuse = (why) => ({ ok: false, steps, why });
+  try {
+    steps.push("upload");
+    const uploaded = await runner.ask({ step: "upload" }, input.timeoutMs);
+    const versionId = stringAt(uploaded, "versionId");
+    if (versionId === void 0) {
+      return refuse("the runner\u2019s upload answered no versionId, so there is nothing to override to");
+    }
+    steps.push("smoke");
+    const smoked = await runner.ask({ step: "smoke", versionId }, input.timeoutMs);
+    if (smoked["ok"] !== true) return refuse(`the smoke of ${versionId} did not pass`);
+    const answered = stringAt(smoked, "answeredVersionId");
+    if (answered === void 0) {
+      return refuse(`the smoke of ${versionId} named no version. ${WHY_VERSION_IDENTITY}`);
+    }
+    if (answered !== versionId) {
+      return refuse(
+        `the smoke overrode to ${versionId} and ${answered} answered. ${WHY_VERSION_IDENTITY}`
+      );
+    }
+    steps.push("promote");
+    const promoted = await runner.ask({ step: "promote", versionId }, input.timeoutMs);
+    if (promoted["ok"] !== true) return refuse(`the promote of ${versionId} did not pass`);
+    const went = stringAt(promoted, "promotedVersionId");
+    if (went !== void 0 && went !== versionId) {
+      return refuse(`${versionId} was proved and ${went} was promoted \u2014 nothing proved ${went}`);
+    }
+    return { ok: true, steps };
+  } finally {
+    runner.close();
+  }
+};
+var PLANTS = [
+  {
+    name: "answered",
+    says: "a smoke that answered a version other than the one it overrode to is refused"
+  },
+  { name: "failed", says: "a smoke that did not pass is refused" },
+  { name: "promoted", says: "a promote of a version nothing proved is refused" }
+];
+var stubPath = () => {
+  const path = fileURLToPath2(new URL("./stub-runner.js", import.meta.url));
+  if (!existsSync4(path)) throw new CannotRun(`${path} is missing \u2014 run pnpm build first`);
+  return path;
+};
+var prove = async (cwd, stub = stubPath()) => {
+  const lines = [];
+  let ok = true;
+  for (const plant of PLANTS) {
+    const verdict = await proveOver({
+      args: [stub, `--plant=${plant.name}`],
+      command: process.execPath,
+      cwd,
+      timeoutMs: 3e4
+    });
+    if (verdict.ok) ok = false;
+    lines.push(`  ${verdict.ok ? "MISSED" : "PROVEN"} ${plant.says}`);
+    if (plant.name !== "promoted" && verdict.steps.includes("promote")) {
+      ok = false;
+      lines.push("  MISSED a refused smoke was followed by a promote request");
+    }
+  }
+  const honest = await proveOver({
+    args: [stub, "--plant=good"],
+    command: process.execPath,
+    cwd,
+    timeoutMs: 3e4
+  });
+  if (!honest.ok) ok = false;
+  lines.push(
+    `  ${honest.ok ? "PROVEN" : "MISSED"} a smoke that answered the version it overrode to is not refused`
+  );
+  return { lines, ok };
+};
+var formatProve = (outcome) => `${outcome.lines.join("\n")}
+
+prove ${outcome.ok ? "PASS" : "FAIL"} \u2014 ${outcome.ok ? "every plant was refused, and the honest runner was not" : "a plant went through"}.
+`;
+var formatVerdict = (verdict) => verdict.ok ? `OK    prove: ${verdict.steps.join(" \u2192 ")}
+` : `  REFUSED after ${verdict.steps.join(" \u2192 ")}: ${verdict.why ?? ""}
+`;
+
+export {
+  CannotRun,
+  parseReleaseConfig,
+  readReleaseConfig,
+  parseJsonc,
+  parseToml,
+  declaredIn,
+  readWrangler,
+  DEPLOYED_FILE,
+  NOTHING_SAYS,
+  readDeployed,
+  driftBetween,
+  runDeployed,
+  formatDeployed,
+  markersIn,
+  addSqlIn,
+  NARROWING,
+  statementsOf,
+  refusalsIn,
+  runMigrations,
+  formatMigrations,
+  STEPS,
+  WHY_VERSION_IDENTITY,
+  runPlan,
+  formatPlan,
+  Runner,
+  proveOver,
+  PLANTS,
+  prove,
+  formatProve,
+  formatVerdict
+};