@geonosis/release 1.4.0 → 2.0.0

package/dist/chunk-KQIWTXQP.js

@@ -0,0 +1,2134 @@
+// src/config.ts
+import { existsSync, readFileSync } from "fs";
+import { resolve } from "path";
+var CannotRun = class extends Error {
+};
+var DIALECTS = /* @__PURE__ */ new Set(["mikro-orm-ts", "postgres", "sqlite"]);
+var isRecord = (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+var strings = (value2, where) => {
+  if (value2 === void 0) return [];
+  if (!Array.isArray(value2) || value2.some((one) => typeof one !== "string")) {
+    throw new CannotRun(`${where} must be a list of strings`);
+  }
+  return value2;
+};
+var ENTRY_KEYS = "expected { dir, dialect, phases?, squawk? }";
+var oneDir = (value2, index) => {
+  const at = `release.migrations[${index}]`;
+  if (!isRecord(value2)) throw new CannotRun(`${at} must be an object \u2014 ${ENTRY_KEYS}`);
+  const known = /* @__PURE__ */ new Set(["dialect", "dir", "phases", "squawk"]);
+  const unknown = Object.keys(value2).find((key) => !known.has(key));
+  if (unknown !== void 0) {
+    throw new CannotRun(`${at}.${unknown} is not a key it takes \u2014 ${ENTRY_KEYS}`);
+  }
+  const dir = value2["dir"];
+  const dialect = value2["dialect"];
+  if (typeof dir !== "string" || dir === "") {
+    throw new CannotRun(`${at}.dir must name a directory \u2014 ${ENTRY_KEYS}`);
+  }
+  if (typeof dialect !== "string" || !DIALECTS.has(dialect)) {
+    throw new CannotRun(
+      `${at}.dialect must be one of ${[...DIALECTS].toSorted().join(", ")} \u2014 ${ENTRY_KEYS}`
+    );
+  }
+  const phases = strings(value2["phases"], `${at}.phases`);
+  for (const phase of phases) {
+    if (phase !== "up" && phase !== "down") {
+      throw new CannotRun(`${at}.phases may only hold "up" and "down"`);
+    }
+  }
+  const squawk = value2["squawk"];
+  const exclude = isRecord(squawk) ? strings(squawk["exclude"], `${at}.squawk.exclude`) : [];
+  return {
+    dialect,
+    dir,
+    // `down()` holds the drop in every MikroORM migration in the corpus this was built from, and a
+    // down that is never run against a live database cannot narrow a schema anyone is serving.
+    phases: phases.length === 0 ? ["up"] : phases,
+    squawk: { exclude }
+  };
+};
+var EMPTY = {
+  migrations: [],
+  proof: {},
+  secrets: [],
+  smoke: { exclude: [], snapshots: [] },
+  steps: [],
+  workers: [],
+  wrangler: []
+};
+var BLOCK_KEYS = "expected { migrations?, proof?, schema?, secrets?, smoke?, steps?, workers?, wrangler?, wranglerEnv? }";
+var SCHEMA_KEYS = "expected { domains?, sessionVariables? }";
+var DOMAIN_KEYS = "expected { dir, name, tables }";
+var oneSchemaDomain = (value2, index) => {
+  const at = `release.schema.domains[${index}]`;
+  if (!isRecord(value2)) throw new CannotRun(`${at} must be an object \u2014 ${DOMAIN_KEYS}`);
+  const known = /* @__PURE__ */ new Set(["dir", "name", "tables"]);
+  const unknown = Object.keys(value2).find((key) => !known.has(key));
+  if (unknown !== void 0) {
+    throw new CannotRun(`${at}.${unknown} is not a key it takes \u2014 ${DOMAIN_KEYS}`);
+  }
+  const dir = value2["dir"];
+  const name = value2["name"];
+  if (typeof dir !== "string" || dir === "") {
+    throw new CannotRun(`${at}.dir must name the directory holding that domain's migrations`);
+  }
+  if (typeof name !== "string" || name === "") {
+    throw new CannotRun(`${at}.name must name the domain those tables belong to`);
+  }
+  return { dir, name, tables: strings(value2["tables"], `${at}.tables`) };
+};
+var parseSchema = (value2) => {
+  if (value2 === void 0) return void 0;
+  if (!isRecord(value2)) throw new CannotRun(`release.schema must be an object \u2014 ${SCHEMA_KEYS}`);
+  const unknown = Object.keys(value2).find((key) => key !== "domains" && key !== "sessionVariables");
+  if (unknown !== void 0) {
+    throw new CannotRun(`release.schema.${unknown} is not a key it reads \u2014 ${SCHEMA_KEYS}`);
+  }
+  const domains = value2["domains"];
+  if (domains !== void 0 && !Array.isArray(domains)) {
+    throw new CannotRun(`release.schema.domains must be a list \u2014 ${DOMAIN_KEYS}, per entry`);
+  }
+  return {
+    domains: (domains ?? []).map(oneSchemaDomain),
+    sessionVariables: strings(value2["sessionVariables"], "release.schema.sessionVariables")
+  };
+};
+var SMOKE_KEYS = "expected { exclude?, snapshots? }";
+var oneSnapshot = (value2, index) => {
+  const at = `release.smoke.snapshots[${index}]`;
+  if (!isRecord(value2)) throw new CannotRun(`${at} must be an object \u2014 expected { name, install? }`);
+  const unknown = Object.keys(value2).find((key) => key !== "install" && key !== "name");
+  if (unknown !== void 0) {
+    throw new CannotRun(`${at}.${unknown} is not a key it takes \u2014 expected { name, install? }`);
+  }
+  const name = value2["name"];
+  if (typeof name !== "string" || name === "") {
+    throw new CannotRun(`${at}.name must name a snapshot recorded under .geonosis/`);
+  }
+  const install = value2["install"];
+  if (install !== void 0 && typeof install !== "string") {
+    throw new CannotRun(`${at}.install must be the command that installs that tree`);
+  }
+  return { ...install === void 0 ? {} : { install }, name };
+};
+var parseSmoke = (value2) => {
+  if (value2 === void 0) return { exclude: [], snapshots: [] };
+  if (!isRecord(value2)) throw new CannotRun(`release.smoke must be an object \u2014 ${SMOKE_KEYS}`);
+  const unknown = Object.keys(value2).find((key) => key !== "exclude" && key !== "snapshots");
+  if (unknown !== void 0) {
+    throw new CannotRun(`release.smoke.${unknown} is not a key it reads \u2014 ${SMOKE_KEYS}`);
+  }
+  const snapshots = value2["snapshots"];
+  if (snapshots !== void 0 && !Array.isArray(snapshots)) {
+    throw new CannotRun("release.smoke.snapshots must be a list of { name, install? }");
+  }
+  return {
+    exclude: strings(value2["exclude"], "release.smoke.exclude"),
+    snapshots: (snapshots ?? []).map(oneSnapshot)
+  };
+};
+var parseReleaseConfig = (raw) => {
+  if (!isRecord(raw)) return EMPTY;
+  const release = raw["release"];
+  if (!isRecord(release)) return EMPTY;
+  const known = /* @__PURE__ */ new Set([
+    "migrations",
+    "proof",
+    "schema",
+    "secrets",
+    "smoke",
+    "steps",
+    "workers",
+    "wrangler",
+    "wranglerEnv"
+  ]);
+  const unknown = Object.keys(release).find((key) => !known.has(key));
+  if (unknown !== void 0) {
+    throw new CannotRun(`release.${unknown} is not a key it reads \u2014 ${BLOCK_KEYS}`);
+  }
+  const migrations = release["migrations"];
+  if (migrations !== void 0 && !Array.isArray(migrations)) {
+    throw new CannotRun(`release.migrations must be a list \u2014 ${ENTRY_KEYS}, per entry`);
+  }
+  const proof = release["proof"];
+  return {
+    migrations: (migrations ?? []).map(oneDir),
+    proof: isRecord(proof) ? { mustAssertVersion: proof["mustAssertVersion"] !== false } : {},
+    schema: parseSchema(release["schema"]),
+    secrets: strings(release["secrets"], "release.secrets"),
+    smoke: parseSmoke(release["smoke"]),
+    steps: strings(release["steps"], "release.steps"),
+    workers: strings(release["workers"], "release.workers"),
+    wrangler: strings(release["wrangler"], "release.wrangler"),
+    wranglerEnv: typeof release["wranglerEnv"] === "string" ? release["wranglerEnv"] : void 0
+  };
+};
+var readReleaseConfig = (root) => {
+  const path = resolve(root, "geonosis.json");
+  if (!existsSync(path)) return EMPTY;
+  try {
+    return parseReleaseConfig(JSON.parse(readFileSync(path, "utf8")));
+  } catch (error) {
+    if (error instanceof CannotRun) throw error;
+    throw new CannotRun(`${path} is not readable JSON: ${error.message}`);
+  }
+};
+
+// src/wrangler.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
+var isRecord2 = (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+var parseJsonc = (source) => {
+  let out = "";
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index] ?? "";
+    if (char === '"') {
+      const start = index;
+      index += 1;
+      for (; index < source.length; index += 1) {
+        if (source[index] === "\\") {
+          index += 1;
+          continue;
+        }
+        if (source[index] === '"') break;
+      }
+      out += source.slice(start, index + 1);
+      continue;
+    }
+    if (char === "/" && source[index + 1] === "/") {
+      const end = source.indexOf("\n", index);
+      index = end === -1 ? source.length : end - 1;
+      continue;
+    }
+    if (char === "/" && source[index + 1] === "*") {
+      const end = source.indexOf("*/", index + 2);
+      index = end === -1 ? source.length : end + 1;
+      continue;
+    }
+    out += char;
+  }
+  return JSON.parse(out.replaceAll(/,(\s*[\]}])/g, "$1"));
+};
+var literal = (text) => {
+  const value2 = text.trim();
+  if (value2.startsWith('"') || value2.startsWith("'")) return value2.slice(1, -1);
+  if (value2 === "true") return true;
+  if (value2 === "false") return false;
+  const number = Number(value2);
+  return Number.isNaN(number) ? value2 : number;
+};
+var split = (text, delimiter) => {
+  const parts = [];
+  let depth = 0;
+  let quote = "";
+  let current = "";
+  for (const char of text) {
+    if (quote !== "") {
+      current += char;
+      if (char === quote) quote = "";
+      continue;
+    }
+    if (char === '"' || char === "'") quote = char;
+    if (char === "[" || char === "{") depth += 1;
+    if (char === "]" || char === "}") depth -= 1;
+    if (char === delimiter && depth === 0) {
+      parts.push(current);
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  parts.push(current);
+  return parts.filter((one) => one.trim() !== "");
+};
+var value = (text) => {
+  const trimmed = text.trim();
+  if (trimmed.startsWith("[")) return split(trimmed.slice(1, -1), ",").map(value);
+  if (trimmed.startsWith("{")) {
+    return Object.fromEntries(
+      split(trimmed.slice(1, -1), ",").map((pair) => {
+        const at = pair.indexOf("=");
+        return [pair.slice(0, at).trim(), value(pair.slice(at + 1))];
+      })
+    );
+  }
+  return literal(trimmed);
+};
+var put = (into, path, leaf) => {
+  let here = into;
+  for (const key of path.slice(0, -1)) {
+    if (!isRecord2(here[key])) here[key] = {};
+    here = here[key];
+  }
+  here[path.at(-1) ?? ""] = leaf;
+};
+var table = (into, path) => {
+  let here = into;
+  for (const key of path) {
+    if (!isRecord2(here[key])) here[key] = {};
+    here = here[key];
+  }
+  return here;
+};
+var arrayTable = (into, path) => {
+  let here = into;
+  for (const key of path.slice(0, -1)) {
+    if (!isRecord2(here[key])) here[key] = {};
+    here = here[key];
+  }
+  const last = path.at(-1) ?? "";
+  if (!Array.isArray(here[last])) here[last] = [];
+  const list = here[last];
+  const entry = {};
+  list.push(entry);
+  return entry;
+};
+var parseToml = (source) => {
+  const out = {};
+  let here = out;
+  const lines2 = source.split("\n");
+  for (let index = 0; index < lines2.length; index += 1) {
+    const line = (lines2[index] ?? "").split("#")[0]?.trim() ?? "";
+    if (line === "") continue;
+    if (line.startsWith("[[") && line.endsWith("]]")) {
+      here = arrayTable(out, line.slice(2, -2).trim().split("."));
+      continue;
+    }
+    if (line.startsWith("[") && line.endsWith("]")) {
+      here = table(out, line.slice(1, -1).trim().split("."));
+      continue;
+    }
+    const at = line.indexOf("=");
+    if (at === -1) continue;
+    let text = line.slice(at + 1);
+    while ([...text].filter((one) => one === "[").length > [...text].filter((one) => one === "]").length) {
+      index += 1;
+      if (index >= lines2.length) throw new CannotRun("an unterminated array in the TOML config");
+      text += `
+${(lines2[index] ?? "").split("#")[0] ?? ""}`;
+    }
+    put(here, line.slice(0, at).trim().split("."), value(text));
+  }
+  return out;
+};
+var BINDING_LISTS = [
+  "ai",
+  "analytics_engine_datasets",
+  "browser",
+  "d1_databases",
+  "dispatch_namespaces",
+  "durable_objects",
+  "hyperdrive",
+  "kv_namespaces",
+  "mtls_certificates",
+  "queues",
+  "r2_buckets",
+  "send_email",
+  "services",
+  "vectorize",
+  "version_metadata",
+  "workflows"
+];
+var bindingsOf = (found) => {
+  if (Array.isArray(found)) return found.flatMap(bindingsOf);
+  if (!isRecord2(found)) return [];
+  const named = found["binding"] ?? found["name"];
+  const here = typeof named === "string" ? [named] : [];
+  const nested = Object.entries(found).filter(([key]) => key === "bindings" || key === "producers" || key === "consumers").flatMap(([, one]) => bindingsOf(one));
+  return [...here, ...nested];
+};
+var declaredIn = (config) => {
+  const triggers = config["triggers"];
+  const crons = isRecord2(triggers) && Array.isArray(triggers["crons"]) ? triggers["crons"] : [];
+  const routes = config["routes"];
+  const one = config["route"];
+  const listed = [
+    ...Array.isArray(routes) ? routes : [],
+    ...typeof one === "string" ? [one] : []
+  ];
+  return {
+    bindings: BINDING_LISTS.flatMap((key) => bindingsOf(config[key])).toSorted(),
+    crons: crons.filter((cron) => typeof cron === "string").toSorted(),
+    routes: listed.map((route) => isRecord2(route) ? route["pattern"] : route).filter((pattern) => typeof pattern === "string").toSorted()
+  };
+};
+var readWrangler = (root, relative5, env) => {
+  const path = resolve2(root, relative5);
+  let parsed;
+  try {
+    const source = readFileSync2(path, "utf8");
+    parsed = relative5.endsWith(".toml") ? parseToml(source) : parseJsonc(source);
+  } catch (error) {
+    throw new CannotRun(`${relative5} could not be read: ${error.message}`);
+  }
+  if (!isRecord2(parsed)) throw new CannotRun(`${relative5} is not a wrangler configuration`);
+  const environments = parsed["env"];
+  const block = env !== void 0 && isRecord2(environments) && isRecord2(environments[env]) ? environments[env] : parsed;
+  return declaredIn(block);
+};
+
+// src/deployed.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve3 } from "path";
+var DEPLOYED_FILE = ".geonosis/deployed.json";
+var NOTHING_SAYS = "nothing here says what is deployed \u2014 .geonosis/deployed.json is written by the pipeline after promote, and its absence is not a pass";
+var listOf = (found) => Array.isArray(found) ? found.filter((one) => typeof one === "string") : [];
+var isRecord3 = (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+var readDeployed = (root) => {
+  const path = resolve3(root, DEPLOYED_FILE);
+  if (!existsSync2(path)) throw new CannotRun(NOTHING_SAYS);
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync3(path, "utf8"));
+  } catch (error) {
+    throw new CannotRun(`${DEPLOYED_FILE} is not readable JSON: ${error.message}`);
+  }
+  if (!isRecord3(parsed)) throw new CannotRun(`${DEPLOYED_FILE} is not an object`);
+  const triggers = isRecord3(parsed["triggers"]) ? parsed["triggers"] : {};
+  return {
+    ...typeof parsed["at"] === "string" ? { at: parsed["at"] } : {},
+    deployed: {
+      bindings: listOf(parsed["bindings"]),
+      crons: listOf(triggers["crons"]),
+      routes: listOf(triggers["routes"]),
+      secrets: listOf(parsed["secrets"])
+    }
+  };
+};
+var missingBetween = (kind, declared, deployed) => {
+  const missing = declared.filter((one) => !deployed.includes(one));
+  const extra = deployed.filter((one) => !declared.includes(one));
+  return missing.length === 0 && extra.length === 0 ? [] : [{ extra, kind, missing }];
+};
+var driftBetween = (declared, deployed) => [
+  ...missingBetween("crons", declared.crons, deployed.crons),
+  ...missingBetween("routes", declared.routes, deployed.routes),
+  ...missingBetween("bindings", declared.bindings, deployed.bindings),
+  ...missingBetween("secrets", declared.secrets, deployed.secrets)
+];
+var runDeployed = (input) => {
+  const config = readReleaseConfig(input.root);
+  const configs = config.wrangler ?? [];
+  const secrets = config.secrets ?? [];
+  if (configs.length === 0 && secrets.length === 0) {
+    throw new CannotRun(
+      "geonosis.json names no release.wrangler configs and no release.secrets \u2014 nothing here declares what a deployment is supposed to carry"
+    );
+  }
+  const found = configs.map((one) => readWrangler(input.root, one, config.wranglerEnv));
+  const declared = {
+    bindings: [...new Set(found.flatMap((one) => one.bindings))].toSorted(),
+    crons: [...new Set(found.flatMap((one) => one.crons))].toSorted(),
+    routes: [...new Set(found.flatMap((one) => one.routes))].toSorted(),
+    secrets: [...secrets].toSorted()
+  };
+  const { at, deployed } = readDeployed(input.root);
+  const drift = driftBetween(declared, deployed);
+  return { ...at === void 0 ? {} : { at }, drift, ok: drift.length === 0 };
+};
+var formatDeployed = (report) => {
+  if (report.ok) {
+    return `OK    deployed: what the tree declares is what the pipeline reported${report.at === void 0 ? "" : ` at ${report.at}`}
+`;
+  }
+  return report.drift.flatMap((one) => [
+    ...one.missing.length === 0 ? [] : [`  declared but not deployed  ${one.kind}: ${one.missing.join(", ")}
+`],
+    ...one.extra.length === 0 ? [] : [`  deployed but not declared  ${one.kind}: ${one.extra.join(", ")}
+`]
+  ]).join("");
+};
+
+// src/added.ts
+import { execFileSync, spawnSync } from "child_process";
+var git = (root, args) => {
+  try {
+    return execFileSync("git", [...args], { cwd: root, encoding: "utf8", stdio: "pipe" });
+  } catch (error) {
+    throw new CannotRun(`git ${args.join(" ")} failed: ${(error.message ?? "").trim()}`);
+  }
+};
+var lines = (out) => out.split("\n").filter((line) => line !== "");
+var addedSince = (root, since) => {
+  const committed = lines(git(root, ["diff", "--name-only", "--diff-filter=A", `${since}..HEAD`]));
+  const staged = lines(git(root, ["diff", "--name-only", "--diff-filter=A", "--cached"]));
+  const untracked = lines(git(root, ["ls-files", "--others", "--exclude-standard"]));
+  return [.../* @__PURE__ */ new Set([...committed, ...staged, ...untracked])].toSorted();
+};
+var gitOk = (root, args) => {
+  const run = spawnSync("git", [...args], { cwd: root, encoding: "utf8" });
+  return run.error === void 0 && run.status === 0;
+};
+
+// src/marker.ts
+var MARKER = /^[^\S\n]*(?:--|\/\/)[^\S\n]*contract-migration:[^\S\n]*(.*)$/gim;
+var SINCE = /(?:^|\s)since:(\S+)/;
+var markersIn = (source) => {
+  const out = [];
+  MARKER.lastIndex = 0;
+  for (let found = MARKER.exec(source); found !== null; found = MARKER.exec(source)) {
+    const tail = found[1] ?? "";
+    const since = SINCE.exec(tail)?.[1];
+    out.push({
+      line: source.slice(0, found.index).split("\n").length,
+      reason: (since === void 0 ? tail : tail.replace(SINCE, " ")).trim(),
+      ...since === void 0 ? {} : { since }
+    });
+  }
+  return out;
+};
+var judge = (marker, root, base) => {
+  if (marker.reason === "") {
+    return "the marker gives no reason \u2014 a marker with nothing after the colon is a comment";
+  }
+  if (marker.since === void 0) {
+    return "the marker has no since:<ref> \u2014 an expand nobody can date excuses nothing";
+  }
+  if (!gitOk(root, ["rev-parse", "--verify", "--quiet", `${marker.since}^{commit}`])) {
+    return `since:${marker.since} is a ref git does not know`;
+  }
+  if (!gitOk(root, ["merge-base", "--is-ancestor", marker.since, base])) {
+    return `since:${marker.since} is not an ancestor of ${base} \u2014 the expand it names is inside this release, so nothing has drained`;
+  }
+  return void 0;
+};
+
+// src/mikro.ts
+var Unreadable = class extends Error {
+};
+var isSpace = (char) => char === " " || char === "	" || char === "\n" || char === "\r";
+var advance = (source, at, to) => {
+  for (let index = at.index; index < to; index += 1) {
+    if (source[index] === "\n") at.line += 1;
+  }
+  at.index = to;
+};
+var skipTrivia = (source, at) => {
+  for (; ; ) {
+    while (at.index < source.length && isSpace(source[at.index] ?? "")) {
+      if (source[at.index] === "\n") at.line += 1;
+      at.index += 1;
+    }
+    if (source.startsWith("//", at.index)) {
+      const end = source.indexOf("\n", at.index);
+      advance(source, at, end === -1 ? source.length : end);
+      continue;
+    }
+    if (source.startsWith("/*", at.index)) {
+      const end = source.indexOf("*/", at.index + 2);
+      if (end === -1) throw new Unreadable("an unterminated block comment");
+      advance(source, at, end + 2);
+      continue;
+    }
+    return;
+  }
+};
+var readLiteral = (source, at) => {
+  const quote = source[at.index];
+  if (quote !== "`" && quote !== "'" && quote !== '"') {
+    throw new Unreadable(`an argument that is not a string literal: ${nameOf(source, at.index)}`);
+  }
+  let out = "";
+  let index = at.index + 1;
+  for (; index < source.length; index += 1) {
+    const char = source[index] ?? "";
+    if (char === "\\") {
+      out += source[index + 1] ?? "";
+      index += 1;
+      continue;
+    }
+    if (quote === "`" && char === "$" && source[index + 1] === "{") {
+      throw new Unreadable("a template literal with an interpolation");
+    }
+    if (char === quote) {
+      advance(source, at, index + 1);
+      return out;
+    }
+    out += char;
+  }
+  throw new Unreadable("an unterminated string literal");
+};
+var nameOf = (source, index) => {
+  const rest = source.slice(index);
+  const end = rest.search(/[),\n]/);
+  return (end === -1 ? rest : rest.slice(0, end)).trim();
+};
+var addSqlIn = (source, phases) => {
+  const out = [];
+  for (const phase of phases) {
+    const body = phaseBody(source, phase);
+    if (body === void 0) continue;
+    const at = { index: 0, line: body.line };
+    const calls = /(?:^|[^\w$.])(?:this\.)?addSql\s*\(/g;
+    for (let found = calls.exec(body.text); found !== null; found = calls.exec(body.text)) {
+      advance(body.text, at, found.index + found[0].length);
+      skipTrivia(body.text, at);
+      const line = at.line;
+      let sql = readLiteral(body.text, at);
+      for (; ; ) {
+        skipTrivia(body.text, at);
+        if (body.text[at.index] !== "+") break;
+        advance(body.text, at, at.index + 1);
+        skipTrivia(body.text, at);
+        sql += readLiteral(body.text, at);
+      }
+      out.push({ line, sql });
+      calls.lastIndex = at.index;
+    }
+  }
+  return out.toSorted((a, b) => a.line - b.line);
+};
+var phaseBody = (source, phase) => {
+  const blanked = blank(source);
+  const opener = new RegExp(`\\b${phase}\\s*\\([^)]*\\)[^{;]*\\{`);
+  const found = opener.exec(blanked);
+  if (found === null) return void 0;
+  const open = found.index + found[0].length - 1;
+  let depth = 0;
+  for (let index = open; index < blanked.length; index += 1) {
+    if (blanked[index] === "{") depth += 1;
+    if (blanked[index] === "}") {
+      depth -= 1;
+      if (depth === 0) {
+        return {
+          line: source.slice(0, open + 1).split("\n").length,
+          text: source.slice(open + 1, index)
+        };
+      }
+    }
+  }
+  throw new Unreadable(`an unbalanced ${phase}() body`);
+};
+var blank = (source) => {
+  const out = [...source];
+  const hide = (from, to) => {
+    for (let index = from; index < to && index < out.length; index += 1) {
+      if (out[index] !== "\n") out[index] = " ";
+    }
+  };
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index] ?? "";
+    if (char === "/" && source[index + 1] === "/") {
+      const end2 = source.indexOf("\n", index);
+      const stop = end2 === -1 ? source.length : end2;
+      hide(index, stop);
+      index = stop;
+      continue;
+    }
+    if (char === "/" && source[index + 1] === "*") {
+      const end2 = source.indexOf("*/", index + 2);
+      const stop = end2 === -1 ? source.length : end2 + 2;
+      hide(index, stop);
+      index = stop - 1;
+      continue;
+    }
+    if (char !== "`" && char !== "'" && char !== '"') continue;
+    let end = index + 1;
+    for (; end < source.length; end += 1) {
+      if (source[end] === "\\") {
+        end += 1;
+        continue;
+      }
+      if (source[end] === char) break;
+    }
+    hide(index + 1, end);
+    index = end;
+  }
+  return out.join("");
+};
+
+// src/sql.ts
+var NARROWING = [
+  ["DROP TABLE", /\bDROP\s+TABLE\b/i],
+  ["DROP COLUMN", /\bDROP\s+COLUMN\b/i],
+  ["RENAME", /\bRENAME\b/i],
+  ["ALTER COLUMN \u2026 TYPE", /\bALTER\s+COLUMN\b[^;]*\bTYPE\b/i],
+  ["SET NOT NULL", /\bSET\s+NOT\s+NULL\b/i]
+];
+var statementsOf = (sql) => sql.replaceAll(/'[^']*'/g, (found) => `'${found.slice(1, -1).replaceAll(/[^\n]/g, " ")}'`);
+var lineOf = (body, index) => body.slice(0, index).split("\n").length;
+var refusalsIn = (path, body, firstLine = 1) => {
+  const stripped = statementsOf(body);
+  return NARROWING.flatMap(([verb, pattern]) => {
+    const found = pattern.exec(stripped);
+    return found === null ? [] : [{ line: lineOf(stripped, found.index) + firstLine - 1, path, verb }];
+  });
+};
+
+// src/migrations.ts
+import { mkdtempSync, readFileSync as readFileSync4, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { basename, join, resolve as resolve5 } from "path";
+
+// src/squawk.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync3 } from "fs";
+import { dirname, resolve as resolve4 } from "path";
+import { fileURLToPath } from "url";
+var HERE = dirname(fileURLToPath(import.meta.url));
+var PINNED = "2.63.0";
+var findSquawk = (from = HERE) => {
+  for (let dir = from; ; dir = dirname(dir)) {
+    const candidate = resolve4(dir, "node_modules/.bin/squawk");
+    if (existsSync3(candidate)) return candidate;
+    if (dirname(dir) === dir) break;
+  }
+  throw new CannotRun(
+    `squawk-cli is not installed beside this package, and the postgres and mikro-orm-ts dialects cannot be measured without it \u2014 a gate that cannot measure has not passed. Install it:
+
+    pnpm add -D squawk-cli@${PINNED}
+
+It is an optional peer: a repo whose release.migrations names only the sqlite dialect needs none of this.`
+  );
+};
+var squawkOn = (input) => {
+  const { cwd, exclude, files } = input;
+  if (files.length === 0) return { findings: "", ok: true };
+  const run = spawnSync2(
+    input.bin ?? findSquawk(),
+    [...exclude.length === 0 ? [] : [`--exclude=${exclude.join(",")}`], ...files],
+    { cwd, encoding: "utf8" }
+  );
+  if (run.error !== void 0) {
+    throw new CannotRun(`squawk could not be started: ${run.error.message}`);
+  }
+  const findings = `${run.stdout}${run.stderr}`;
+  if (run.status === 0) return { findings, ok: true };
+  if (run.status === 1) return { findings, ok: false };
+  throw new CannotRun(
+    `squawk exited ${String(run.status)}, which is neither clean nor findings:
+${findings}`
+  );
+};
+
+// src/migrations.ts
+var EXTENSION = {
+  "mikro-orm-ts": ".ts",
+  postgres: ".sql",
+  sqlite: ".sql"
+};
+var under = (dir, file) => file === dir || file.startsWith(dir.endsWith("/") ? dir : `${dir}/`);
+var fromTypeScript = (path, source, entry) => {
+  try {
+    return {
+      refusals: addSqlIn(source, entry.phases ?? ["up"]).flatMap(
+        (one) => refusalsIn(path, one.sql, one.line)
+      )
+    };
+  } catch (error) {
+    if (error instanceof Unreadable) {
+      return {
+        refusals: [],
+        unreadable: `${path} holds ${error.message} \u2014 this reader cannot read it`
+      };
+    }
+    throw error;
+  }
+};
+var sqlFor = (path, source, entry) => entry.dialect === "mikro-orm-ts" ? addSqlIn(source, entry.phases ?? ["up"]).map((one) => one.sql.trim()).map((one) => one.endsWith(";") ? one : `${one};`).join("\n") : source;
+var runMigrations = (input) => {
+  const config = readReleaseConfig(input.root);
+  const declared = config.migrations ?? [];
+  if (declared.length === 0) {
+    throw new CannotRun(
+      "geonosis.json names no release.migrations \u2014 nothing here says which directories hold migrations, or in which dialect"
+    );
+  }
+  const entries = input.dialect === void 0 ? declared : declared.filter((one) => one.dialect === input.dialect);
+  if (entries.length === 0) {
+    throw new CannotRun(`release.migrations names no directory with dialect "${input.dialect}"`);
+  }
+  const matched = addedSince(input.root, input.since).flatMap((file) => {
+    const entry = entries.find(
+      (one) => under(one.dir, file) && file.endsWith(EXTENSION[one.dialect])
+    );
+    return entry === void 0 ? [] : [{ entry, file }];
+  });
+  const refusals = [];
+  const markers = [];
+  const squawk = [];
+  const unreadable = [];
+  const forSquawk = [];
+  const states = /* @__PURE__ */ new Map();
+  for (const { entry, file } of matched) {
+    const source = readFileSync4(resolve5(input.root, file), "utf8");
+    const found = markersIn(source);
+    const bad = found.flatMap((one) => {
+      const why = judge(one, input.root, input.since);
+      return why === void 0 ? [] : [{ line: one.line, path: file, why }];
+    });
+    markers.push(...bad);
+    const excused = found.length > 0 && bad.length === 0;
+    states.set(file, excused ? "excused" : "clean");
+    if (!excused) {
+      const mine = entry.dialect === "mikro-orm-ts" ? fromTypeScript(file, source, entry) : { refusals: refusalsIn(file, source) };
+      if (mine.unreadable !== void 0) {
+        unreadable.push({ path: file, why: mine.unreadable });
+        states.set(file, "unreadable");
+        continue;
+      }
+      refusals.push(...mine.refusals);
+      if (mine.refusals.length > 0) states.set(file, "refused");
+    }
+    if (bad.length > 0) states.set(file, "refused");
+    if (entry.dialect !== "sqlite")
+      forSquawk.push({ entry, file, sql: sqlFor(file, source, entry) });
+  }
+  let clean = true;
+  if (forSquawk.length > 0) {
+    const staging = mkdtempSync(join(tmpdir(), "geonosis-release-squawk-"));
+    try {
+      for (const one of forSquawk) {
+        const path = one.entry.dialect === "mikro-orm-ts" ? join(staging, `${basename(one.file, ".ts")}.sql`) : resolve5(input.root, one.file);
+        if (one.entry.dialect === "mikro-orm-ts") writeFileSync(path, `${one.sql}
+`);
+        const found = squawkOn({
+          cwd: input.root,
+          exclude: one.entry.squawk?.exclude ?? [],
+          files: [path]
+        });
+        if (!found.ok) {
+          clean = false;
+          squawk.push({ findings: found.findings, path: one.file });
+          if (states.get(one.file) === "clean") states.set(one.file, "findings");
+        }
+      }
+    } finally {
+      rmSync(staging, { force: true, recursive: true });
+    }
+  }
+  return {
+    dirs: entries.map((one) => one.dir),
+    files: matched.map(({ file }) => ({ path: file, state: states.get(file) ?? "clean" })),
+    linted: forSquawk.length,
+    markers: markers.toSorted((a, b) => a.path.localeCompare(b.path) || a.line - b.line),
+    ok: refusals.length === 0 && markers.length === 0 && clean && unreadable.length === 0,
+    read: matched.length - unreadable.length,
+    since: input.since,
+    refusals: refusals.toSorted(
+      (a, b) => a.path.localeCompare(b.path) || a.line - b.line || a.verb.localeCompare(b.verb)
+    ),
+    squawk,
+    unreadable
+  };
+};
+var WHY = `
+A release may only WIDEN the schema. Migrations run against live databases while the previous
+version is still serving, and no rollback undoes them. Contract in a later release, or say why it
+is safe now:
+
+  -- contract-migration: <what expanded it, and why nothing reads it any more> since:<ref>
+`;
+var formatMigrations = (report) => {
+  if (report.files.length === 0) {
+    return `NONE  migrations: no migration file was added since ${report.since} \u2014 committed, staged or untracked \u2014 under ${report.dirs.join(", ")}; nothing was read
+`;
+  }
+  if (report.ok) {
+    return `OK    migrations: expand-only (${String(report.read)} read, ${String(report.linted)} linted by squawk)
+`;
+  }
+  const said = report.markers.map((one) => `  ${one.path}: ${one.why} (line ${String(one.line)})
+`);
+  const lines2 = report.refusals.map(
+    (one) => `  ${one.path}: ${one.verb} (line ${String(one.line)})
+`
+  );
+  const found = report.squawk.map((one) => `  ${one.path}:
+${one.findings}
+`);
+  const cannot = report.unreadable.map((one) => `  ${one.why}
+`);
+  const why = report.markers.length + report.refusals.length === 0 ? "" : WHY;
+  return `${said.join("")}${lines2.join("")}${cannot.join("")}${why}${found.join("")}${accounting(report)}`;
+};
+var accounting = (report) => {
+  const total = report.files.length;
+  const by = (state) => report.files.filter((one) => one.state === state).length;
+  const rows = report.files.map((one) => `  ${one.state.padEnd(10)} ${one.path}
+`);
+  return `${rows.join("")}migrations: ${String(report.read)} of ${String(total)} files read \u2014 ${String(by("refused"))} refused, ${String(by("findings"))} with squawk findings, ${String(by("excused"))} excused, ${String(by("clean"))} clean${report.unreadable.length === 0 ? "" : `, ${String(report.unreadable.length)} unreadable`}
+`;
+};
+
+// src/plan.ts
+var STEPS = ["upload", "park", "prove", "promote"];
+var WHY_VERSION_IDENTITY = "An override that was not applied routes by the configured percentages, to the OLD version \u2014 so a smoke that does not assert which version answered can pass by testing the code it was replacing.";
+var runPlan = (input) => {
+  const config = readReleaseConfig(input.root);
+  const steps = config.steps ?? [];
+  if (steps.length === 0) {
+    throw new CannotRun(
+      "geonosis.json names no release.steps \u2014 nothing here says what this repo does to put a version in front of a user"
+    );
+  }
+  const problems = [];
+  const prove2 = steps.indexOf("prove");
+  const promote = steps.indexOf("promote");
+  if (prove2 === -1 || promote === -1 || prove2 > promote) {
+    problems.push(
+      "prove must come before promote \u2014 a promote that has not been proved serves code nothing answered for"
+    );
+  }
+  if (steps.length !== STEPS.length || steps.some((step, at) => step !== STEPS[at])) {
+    problems.push(`release.steps must be exactly ${STEPS.join(" \u2192 ")}, and is ${steps.join(" \u2192 ")}`);
+  }
+  const mustAssert = config.proof?.mustAssertVersion !== false;
+  if (!mustAssert && !input.accept) {
+    problems.push(
+      `release.proof.mustAssertVersion is false. ${WHY_VERSION_IDENTITY} Pass --i-accept-an-unproven-smoke to say so on purpose.`
+    );
+  }
+  return {
+    accepted: !mustAssert && input.accept,
+    ok: problems.length === 0,
+    problems,
+    steps: [...steps]
+  };
+};
+var formatPlan = (report) => {
+  if (!report.ok) return `${report.problems.map((one) => `  ${one}
+`).join("")}`;
+  const note = report.accepted ? `      the smoke need not say which version answered. ${WHY_VERSION_IDENTITY}
+` : "      the smoke asserts the version that answered it\n";
+  return `OK    release: ${report.steps.join(" \u2192 ")}
+${note}`;
+};
+
+// src/runner.ts
+import { spawn } from "child_process";
+var Runner = class {
+  buffered = "";
+  closed;
+  child;
+  waiting = [];
+  constructor(command, args, cwd) {
+    this.child = spawn(command, [...args], { cwd, stdio: ["pipe", "pipe", "pipe"] });
+    this.child.stdout.setEncoding("utf8");
+    this.child.stdout.on("data", (chunk) => {
+      this.buffered += chunk;
+      for (let at = this.buffered.indexOf("\n"); at !== -1; at = this.buffered.indexOf("\n")) {
+        const line = this.buffered.slice(0, at);
+        this.buffered = this.buffered.slice(at + 1);
+        this.waiting.shift()?.(line);
+      }
+    });
+    this.child.on("error", (error) => {
+      this.closed = error.message;
+    });
+    this.child.on("close", () => {
+      this.closed ??= "the runner exited without answering";
+    });
+  }
+  async ask(request, timeoutMs = 6e4) {
+    if (this.closed !== void 0) {
+      throw new CannotRun(`the runner is gone before "${request.step}": ${this.closed}`);
+    }
+    const line = await new Promise((resolve9, reject) => {
+      const timer = setTimeout(() => {
+        reject(
+          new CannotRun(
+            `the runner did not answer "${request.step}" within ${String(timeoutMs)}ms`
+          )
+        );
+      }, timeoutMs);
+      this.waiting.push((answer) => {
+        clearTimeout(timer);
+        resolve9(answer);
+      });
+      this.child.on("close", () => {
+        clearTimeout(timer);
+        reject(new CannotRun(`the runner closed before answering "${request.step}"`));
+      });
+      this.child.stdin.write(`${JSON.stringify(request)}
+`);
+    });
+    try {
+      return JSON.parse(line);
+    } catch {
+      throw new CannotRun(
+        `the runner answered "${request.step}" with something that is not JSON: ${line}`
+      );
+    }
+  }
+  close() {
+    this.child.stdin.end();
+    this.child.kill();
+  }
+};
+
+// src/prove.ts
+import { existsSync as existsSync4 } from "fs";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var stringAt = (reply, key) => typeof reply[key] === "string" ? reply[key] : void 0;
+var proveOver = async (input) => {
+  const runner = new Runner(input.command, input.args ?? [], input.cwd);
+  const steps = [];
+  const refuse = (why) => ({ ok: false, steps, why });
+  try {
+    steps.push("upload");
+    const uploaded = await runner.ask({ step: "upload" }, input.timeoutMs);
+    const versionId = stringAt(uploaded, "versionId");
+    if (versionId === void 0) {
+      return refuse("the runner\u2019s upload answered no versionId, so there is nothing to override to");
+    }
+    steps.push("smoke");
+    const smoked = await runner.ask({ step: "smoke", versionId }, input.timeoutMs);
+    if (smoked["ok"] !== true) return refuse(`the smoke of ${versionId} did not pass`);
+    const answered = stringAt(smoked, "answeredVersionId");
+    if (answered === void 0) {
+      return refuse(`the smoke of ${versionId} named no version. ${WHY_VERSION_IDENTITY}`);
+    }
+    if (answered !== versionId) {
+      return refuse(
+        `the smoke overrode to ${versionId} and ${answered} answered. ${WHY_VERSION_IDENTITY}`
+      );
+    }
+    steps.push("promote");
+    const promoted = await runner.ask({ step: "promote", versionId }, input.timeoutMs);
+    if (promoted["ok"] !== true) return refuse(`the promote of ${versionId} did not pass`);
+    const went = stringAt(promoted, "promotedVersionId");
+    if (went !== void 0 && went !== versionId) {
+      return refuse(`${versionId} was proved and ${went} was promoted \u2014 nothing proved ${went}`);
+    }
+    return { ok: true, steps };
+  } finally {
+    runner.close();
+  }
+};
+var PLANTS = [
+  {
+    name: "answered",
+    says: "a smoke that answered a version other than the one it overrode to is refused"
+  },
+  { name: "failed", says: "a smoke that did not pass is refused" },
+  { name: "promoted", says: "a promote of a version nothing proved is refused" }
+];
+var stubPath = () => {
+  const path = fileURLToPath2(new URL("./stub-runner.js", import.meta.url));
+  if (!existsSync4(path)) throw new CannotRun(`${path} is missing \u2014 run pnpm build first`);
+  return path;
+};
+var prove = async (cwd, stub = stubPath()) => {
+  const lines2 = [];
+  let ok = true;
+  for (const plant of PLANTS) {
+    const verdict = await proveOver({
+      args: [stub, `--plant=${plant.name}`],
+      command: process.execPath,
+      cwd,
+      timeoutMs: 3e4
+    });
+    if (verdict.ok) ok = false;
+    lines2.push(`  ${verdict.ok ? "MISSED" : "PROVEN"} ${plant.says}`);
+    if (plant.name !== "promoted" && verdict.steps.includes("promote")) {
+      ok = false;
+      lines2.push("  MISSED a refused smoke was followed by a promote request");
+    }
+  }
+  const honest = await proveOver({
+    args: [stub, "--plant=good"],
+    command: process.execPath,
+    cwd,
+    timeoutMs: 3e4
+  });
+  if (!honest.ok) ok = false;
+  lines2.push(
+    `  ${honest.ok ? "PROVEN" : "MISSED"} a smoke that answered the version it overrode to is not refused`
+  );
+  return { lines: lines2, ok };
+};
+var formatProve = (outcome) => `${outcome.lines.join("\n")}
+
+prove ${outcome.ok ? "PASS" : "FAIL"} \u2014 ${outcome.ok ? "every plant was refused, and the honest runner was not" : "a plant went through"}.
+`;
+var formatVerdict = (verdict) => verdict.ok ? `OK    prove: ${verdict.steps.join(" \u2192 ")}
+` : `  REFUSED after ${verdict.steps.join(" \u2192 ")}: ${verdict.why ?? ""}
+`;
+
+// src/registry.ts
+var DEFAULT_REGISTRY = "https://registry.npmjs.org";
+var TIMEOUT_MS = 15e3;
+var registryPathOf = (name) => name.startsWith("@") ? `@${encodeURIComponent(name.slice(1))}` : encodeURIComponent(name);
+var versionsIn = (body) => {
+  const versions = body.versions;
+  return typeof versions === "object" && versions !== null ? Object.keys(versions) : [];
+};
+var latestIn = (body) => {
+  const tags = body["dist-tags"];
+  const latest = typeof tags === "object" && tags !== null ? tags.latest : void 0;
+  return typeof latest === "string" ? latest : void 0;
+};
+var askRegistry = async ({
+  name,
+  registry = DEFAULT_REGISTRY,
+  timeoutMs = TIMEOUT_MS
+}) => {
+  const url = `${registry.replace(/\/+$/, "")}/${registryPathOf(name)}`;
+  let response;
+  try {
+    response = await fetch(url, {
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (error) {
+    return { kind: "unreachable", name, why: `GET ${url} \u2014 ${error.message}` };
+  }
+  if (response.status === 404) return { kind: "absent", name };
+  if (!response.ok) {
+    return { kind: "unreachable", name, why: `GET ${url} \u2014 HTTP ${response.status}` };
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (error) {
+    return {
+      kind: "unreachable",
+      name,
+      why: `GET ${url} answered ${response.status} with something that is not JSON \u2014 ${error.message}`
+    };
+  }
+  return { kind: "present", latest: latestIn(body), name, versions: versionsIn(body) };
+};
+
+// src/published.ts
+import { readdirSync, readFileSync as readFileSync5 } from "fs";
+import { join as join2, relative, sep } from "path";
+var NEVER_WALKED = /* @__PURE__ */ new Set(["build", "coverage", "dist", "node_modules", "storybook-static"]);
+var pathOf = (root, path) => relative(root, path).split(sep).join("/");
+var manifestsUnder = (root) => {
+  const found = [];
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (!entry.name.startsWith(".") && !NEVER_WALKED.has(entry.name))
+          walk(join2(dir, entry.name));
+        continue;
+      }
+      if (entry.name === "package.json") found.push(join2(dir, entry.name));
+    }
+  };
+  walk(root);
+  return found;
+};
+var censusOf = (root) => {
+  const excused = [];
+  const locals = [];
+  for (const path of manifestsUnder(root)) {
+    const at = pathOf(root, path);
+    let manifest;
+    try {
+      manifest = JSON.parse(readFileSync5(path, "utf8"));
+    } catch (error) {
+      excused.push({ path: at, reason: `it does not parse: ${error.message}` });
+      continue;
+    }
+    if (manifest.private === true) {
+      excused.push({ path: at, reason: "private: true \u2014 nothing publishes it" });
+      continue;
+    }
+    if (typeof manifest.name !== "string" || manifest.name === "") {
+      excused.push({ path: at, reason: "it names no package" });
+      continue;
+    }
+    if (typeof manifest.version !== "string" || manifest.version === "") {
+      excused.push({ path: at, reason: "it declares no version" });
+      continue;
+    }
+    locals.push({ at, name: manifest.name, version: manifest.version });
+  }
+  return { excused, locals: locals.toSorted((a, b) => a.name.localeCompare(b.name)) };
+};
+var EXISTS_BUT = "exists but no version matching";
+var lineFor = async (local, registry) => {
+  const answer = await askRegistry({ name: local.name, registry });
+  const base = { at: local.at, local: local.version, name: local.name };
+  if (answer.kind === "unreachable") {
+    return { ...base, latest: void 0, verdict: "UNREACHABLE", why: answer.why };
+  }
+  if (answer.kind === "absent") {
+    return {
+      ...base,
+      latest: void 0,
+      verdict: "ABSENT",
+      why: "npm has never heard of this name \u2014 a name published moments ago 404s for a few minutes; --wait <seconds> polls through that window"
+    };
+  }
+  if (answer.latest === local.version) {
+    return { ...base, latest: answer.latest, verdict: "MATCH", why: "on npm" };
+  }
+  return {
+    ...base,
+    latest: answer.latest,
+    verdict: "BEHIND",
+    why: answer.versions.includes(local.version) ? `npm has ${local.version}, and its latest tag is ${answer.latest ?? "nothing"} \u2014 the group has not landed on one version` : `the package ${EXISTS_BUT} ${local.version}; npm answers ${answer.latest ?? "nothing"}. Minutes after a publish, suspect the package manager's manifest cache before the registry`
+  };
+};
+var sleep = (ms) => new Promise((done) => {
+  setTimeout(done, ms);
+});
+var POLL_MS = 5e3;
+var runPublished = async ({
+  pollMs = POLL_MS,
+  registry = DEFAULT_REGISTRY,
+  root,
+  waitSeconds = 0
+}) => {
+  const { excused, locals } = censusOf(root);
+  const startedAt = Date.now();
+  const budgetMs = Math.max(0, waitSeconds * 1e3);
+  let lines2 = [];
+  let sweeps = 0;
+  for (; ; ) {
+    lines2 = [];
+    for (const local of locals) lines2.push(await lineFor(local, registry));
+    sweeps += 1;
+    const settled = lines2.every((one) => one.verdict === "MATCH");
+    const stuck = lines2.some((one) => one.verdict === "UNREACHABLE");
+    const left = budgetMs - (Date.now() - startedAt);
+    if (settled || stuck || left <= 0) break;
+    await sleep(Math.min(pollMs, left));
+  }
+  const unreachable = lines2.filter((one) => one.verdict === "UNREACHABLE").length;
+  return {
+    considered: lines2.length + excused.length,
+    excused: excused.toSorted((a, b) => a.path.localeCompare(b.path)),
+    lines: lines2,
+    ok: lines2.length > 0 && lines2.every((one) => one.verdict === "MATCH"),
+    registry,
+    sweeps,
+    unreachable,
+    waitedMs: Date.now() - startedAt
+  };
+};
+var NOTHING_TO_CHECK = "published FAIL \u2014 no workspace in this tree declares a package a publish could be about, and a check that considered nothing has not passed";
+var formatPublished = (report) => {
+  const width = Math.max(1, ...report.lines.map((one) => one.name.length));
+  const body = report.lines.map((one) => `  ${one.verdict.padEnd(11)} ${one.name.padEnd(width)} ${one.local}  ${one.why}`).join("\n");
+  const head = report.lines.length === 0 ? NOTHING_TO_CHECK : `published ${report.ok ? "PASS" : "FAIL"} \u2014 ${report.lines.filter((one) => one.verdict === "MATCH").length}/${report.lines.length} of the group on ${report.registry}`;
+  const tail = [
+    `considered ${report.considered} manifests: ${report.lines.length} read, ${report.excused.length} excused`,
+    report.sweeps > 1 ? `swept ${report.sweeps} times over ${report.waitedMs} ms` : ""
+  ].filter((one) => one !== "");
+  return `${[head, body, ...tail].filter((one) => one !== "").join("\n")}
+`;
+};
+
+// src/schema-walls.ts
+import { readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
+import { join as join3, relative as relative2, resolve as resolve6, sep as sep2 } from "path";
+var MIGRATION_FILE = /\.(?:sql|ts)$/;
+var CURRENT_SETTING = /current_setting\s*\(\s*'([^']+)'/gi;
+var filesUnder = (root, dir) => {
+  const found = [];
+  const walk = (at) => {
+    let entries;
+    try {
+      entries = readdirSync2(at, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const path = join3(at, entry.name);
+      if (entry.isDirectory()) walk(path);
+      else if (MIGRATION_FILE.test(entry.name)) found.push(path);
+    }
+  };
+  walk(resolve6(root, dir));
+  return found.map((path) => relative2(root, path).split(sep2).join("/")).toSorted();
+};
+var lineOf2 = (body, index) => body.slice(0, index).split("\n").length;
+var wordFor = (table2) => new RegExp(
+  String.raw`(?<![\w.])${table2.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`)}\b`,
+  "i"
+);
+var sqlOf = (path, source) => path.endsWith(".ts") ? addSqlIn(source, ["up", "down"]).map((one) => `${"\n".repeat(Math.max(0, one.line - 1))}${statementsOf(one.sql)}`).join("") : statementsOf(source);
+var foreignTables = (path, sql, schema) => {
+  const mine = schema.domains.find((one) => path.startsWith(`${one.dir}/`));
+  if (mine === void 0) return [];
+  return schema.domains.filter((one) => one.name !== mine.name).flatMap(
+    (other) => other.tables.flatMap((table2) => {
+      const found = wordFor(table2).exec(sql);
+      return found === null ? [] : [
+        {
+          line: lineOf2(sql, found.index),
+          path,
+          why: `"${mine.name}" names "${table2}", which "${other.name}" declares. A domain's migrations may only touch its own tables \u2014 cross-domain talk goes through events, and a foreign key here is a coupling no import graph shows`
+        }
+      ];
+    })
+  );
+};
+var undeclaredSettings = (path, source, schema) => {
+  if (schema.sessionVariables.length === 0) return [];
+  const allowed = new Set(schema.sessionVariables);
+  const found = [];
+  for (const match of source.matchAll(CURRENT_SETTING)) {
+    const name = match[1] ?? "";
+    if (allowed.has(name)) continue;
+    found.push({
+      line: lineOf2(source, match.index),
+      path,
+      why: `current_setting('${name}') names a session variable this repo has not declared. release.schema.sessionVariables holds ${schema.sessionVariables.join(", ")} \u2014 add it there, or take the name as an option so the DDL is not written for one consumer's session`
+    });
+  }
+  return found;
+};
+var runSchema = ({ root }) => {
+  const schema = readReleaseConfig(root).schema;
+  if (schema === void 0) {
+    throw new CannotRun(
+      "geonosis.json names no release.schema \u2014 nothing here says which tables belong to which domain, or which session variables the DDL may name (#168)"
+    );
+  }
+  if (schema.domains.length === 0 && schema.sessionVariables.length === 0) {
+    throw new CannotRun(
+      "release.schema is declared and holds neither domains nor sessionVariables \u2014 say which tables belong to which domain and which session variables the DDL may name, or remove the block: a check with nothing to compare against reads exactly like a clean schema"
+    );
+  }
+  const dirs = schema.domains.map((one) => one.dir);
+  const files = [...new Set(dirs.flatMap((dir) => filesUnder(root, dir)))].toSorted();
+  const findings = [];
+  const unreadable = [];
+  for (const path of files) {
+    const source = readFileSync6(resolve6(root, path), "utf8");
+    let sql;
+    try {
+      sql = sqlOf(path, source);
+    } catch (error) {
+      if (!(error instanceof Unreadable)) throw error;
+      unreadable.push({ path, why: `${path} holds ${error.message} \u2014 this reader cannot read it` });
+      continue;
+    }
+    findings.push(...foreignTables(path, sql, schema), ...undeclaredSettings(path, source, schema));
+  }
+  return {
+    dirs,
+    files,
+    findings: findings.toSorted((a, b) => a.path.localeCompare(b.path) || a.line - b.line),
+    ok: findings.length === 0 && unreadable.length === 0,
+    read: files.length - unreadable.length,
+    unreadable
+  };
+};
+var formatSchema = (report) => {
+  if (report.files.length === 0) {
+    return `NONE  schema: no migration file under ${report.dirs.join(", ")}; nothing was read
+`;
+  }
+  if (report.ok) {
+    return `OK    schema: ${report.read} migration(s) read under ${report.dirs.length} declared domain(s), no wall crossed
+`;
+  }
+  const said = report.findings.map((one) => `  ${one.path}:${one.line}: ${one.why}
+`);
+  const cannot = report.unreadable.map((one) => `  ${one.why}
+`);
+  return `${said.join("")}${cannot.join("")}schema: ${report.read} of ${report.files.length} files read \u2014 ${report.findings.length} finding(s)${report.unreadable.length === 0 ? "" : `, ${report.unreadable.length} unreadable`}
+`;
+};
+
+// src/smoke.ts
+import { spawnSync as spawnSync3 } from "child_process";
+import {
+  cpSync,
+  existsSync as existsSync5,
+  mkdirSync,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync7,
+  rmSync as rmSync2,
+  statSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { join as join4, relative as relative3, resolve as resolve7 } from "path";
+var SNAPSHOTS_DIR = ".geonosis/consumer-snapshots";
+var LOCKFILES = [
+  { file: "bun.lock", manager: "bun" },
+  { file: "bun.lockb", manager: "bun" },
+  { file: "pnpm-lock.yaml", manager: "pnpm" }
+];
+var UNMEASURED = [
+  { file: "package-lock.json", manager: "npm" },
+  { file: "yarn.lock", manager: "yarn" }
+];
+var EXCLUDED_DIRS = [
+  ".cache",
+  ".geonosis",
+  ".git",
+  ".next",
+  ".turbo",
+  ".wrangler",
+  "coverage",
+  "dist",
+  "node_modules",
+  "storybook-static"
+];
+var PHASES = ["typecheck", "lint", "doctor"];
+var DOCTOR_PACKAGE = "@geonosis/doctor";
+var DOCTOR_BIN = "geonosis-doctor";
+var DOCTOR_DOORS = ["@geonosis/cli", "geonosis"];
+var DOOR_BIN = "geonosis doctor";
+var isRecord4 = (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+var readManifest = (path) => {
+  try {
+    const parsed = JSON.parse(readFileSync7(path, "utf8"));
+    return isRecord4(parsed) ? parsed : {};
+  } catch (error) {
+    throw new CannotRun(`${path} is not readable JSON: ${error.message}`);
+  }
+};
+var versionsIn2 = (manifest) => {
+  const found = {};
+  for (const key of ["dependencies", "devDependencies"]) {
+    const block = manifest[key];
+    if (!isRecord4(block)) continue;
+    for (const [name, range] of Object.entries(block)) {
+      if (typeof range === "string") found[name] = range;
+    }
+  }
+  return Object.fromEntries(Object.entries(found).toSorted(([a], [b]) => a.localeCompare(b)));
+};
+var scriptsIn = (manifest) => {
+  const scripts = manifest["scripts"];
+  if (!isRecord4(scripts)) return {};
+  return Object.fromEntries(
+    Object.entries(scripts).filter((one) => typeof one[1] === "string")
+  );
+};
+var copyInto = (from, to, excluded) => {
+  let bytes = 0;
+  let files = 0;
+  const walk = (dir, into) => {
+    mkdirSync(into, { recursive: true });
+    for (const entry of readdirSync3(dir, { withFileTypes: true })) {
+      if (excluded.has(entry.name)) continue;
+      const at = join4(dir, entry.name);
+      if (entry.isDirectory()) {
+        walk(at, join4(into, entry.name));
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      cpSync(at, join4(into, entry.name));
+      bytes += statSync(at).size;
+      files += 1;
+    }
+  };
+  walk(from, to);
+  return { bytes, files };
+};
+var manifestsUnder2 = (root) => {
+  const found = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync3(dir, { withFileTypes: true }).toSorted(
+      (a, b) => a.name.localeCompare(b.name)
+    )) {
+      const at = join4(dir, entry.name);
+      if (entry.isDirectory()) {
+        walk(at);
+        continue;
+      }
+      if (entry.name !== "package.json") continue;
+      found.push({ path: relative3(root, at), versions: versionsIn2(readManifest(at)) });
+    }
+  };
+  walk(root);
+  return found.toSorted((a, b) => a.path.localeCompare(b.path));
+};
+var managerOf = (from) => {
+  const found = LOCKFILES.find((one) => existsSync5(join4(from, one.file)));
+  if (found !== void 0) return { lockfile: found.file, manager: found.manager };
+  const unmeasured = UNMEASURED.find((one) => existsSync5(join4(from, one.file)));
+  if (unmeasured !== void 0) {
+    throw new CannotRun(
+      `${from} is a ${unmeasured.manager} tree (${unmeasured.file}), and the pack \u2192 rewrite \u2192 install path has never been measured under ${unmeasured.manager} here. It reads ${LOCKFILES.map((one) => one.file).join(", ")}.`
+    );
+  }
+  throw new CannotRun(
+    `nothing in ${from} says which runtime installs it \u2014 looked for ${[...LOCKFILES, ...UNMEASURED].map((one) => one.file).join(", ")}. The smoke installs the way the consumer installs, so the manager is read, never assumed.`
+  );
+};
+var commandsFor = (manifest, manifests, named) => {
+  const scripts = scriptsIn(manifest);
+  const installs = (name) => manifests.some((one) => one.versions[name] !== void 0);
+  const doctorCommand = installs(DOCTOR_PACKAGE) ? { exec: DOCTOR_BIN } : DOCTOR_DOORS.some(installs) ? { exec: DOOR_BIN } : {
+    why: `no manifest in this tree installs ${DOCTOR_PACKAGE} or a door that brings it (${DOCTOR_DOORS.join(", ")}), so nothing here can run ${DOCTOR_BIN}`
+  };
+  const phase = (name, fallback) => {
+    const override = named[name];
+    if (override !== void 0) return { exec: override };
+    if (scripts[name] !== void 0) return { run: name };
+    return fallback;
+  };
+  return {
+    doctor: phase("doctor", doctorCommand),
+    lint: phase("lint", { why: 'the tree has no "lint" script and no --lint command was named' }),
+    typecheck: phase("typecheck", {
+      why: 'the tree has no "typecheck" script and no --typecheck command was named'
+    })
+  };
+};
+var snapshotDir = (root, name) => join4(root, SNAPSHOTS_DIR, name);
+var readSnapshot = (root, name) => {
+  const at = join4(snapshotDir(root, name), "snapshot.json");
+  if (!existsSync5(at)) {
+    throw new CannotRun(
+      `there is no snapshot called "${name}" here \u2014 ${at} does not exist. Record one with: geonosis-release smoke snapshot ${name} --from <their tree>`
+    );
+  }
+  return JSON.parse(readFileSync7(at, "utf8"));
+};
+var wouldBeCommitted = (root, path) => {
+  const inside = spawnSync3("git", ["rev-parse", "--is-inside-work-tree"], { cwd: root });
+  if (inside.error !== void 0 || inside.status !== 0) return false;
+  return spawnSync3("git", ["check-ignore", "-q", path], { cwd: root }).status !== 0;
+};
+var NAME_SHAPE = /^[a-z0-9][\w.-]*$/i;
+var runSnapshot = (input) => {
+  if (!NAME_SHAPE.test(input.name)) {
+    throw new CannotRun(
+      `"${input.name}" is not a snapshot name \u2014 a name is letters, digits, dots, dashes and underscores, so that ${SNAPSHOTS_DIR}/<name> is the only place the bytes can land`
+    );
+  }
+  const from = resolve7(input.from);
+  if (!existsSync5(join4(from, "package.json"))) {
+    throw new CannotRun(`${from} has no package.json \u2014 that is not a tree a consumer installs`);
+  }
+  const at = snapshotDir(input.root, input.name);
+  if (wouldBeCommitted(input.root, join4(SNAPSHOTS_DIR, input.name))) {
+    throw new CannotRun(
+      `git here does not ignore ${SNAPSHOTS_DIR}/ \u2014 a consumer's tree is private (D-048) and a copy that reaches a commit cannot be taken back. Add ".geonosis/" to .gitignore and run this again.`
+    );
+  }
+  if (existsSync5(at) && !input.replace) {
+    throw new CannotRun(
+      `${at} is already a snapshot, and a baseline recorded against other bytes is worse than none \u2014 pass --replace to overwrite it`
+    );
+  }
+  const { lockfile, manager } = managerOf(from);
+  const excluded = [.../* @__PURE__ */ new Set([...EXCLUDED_DIRS, ...input.exclude ?? []])].toSorted();
+  rmSync2(at, { force: true, recursive: true });
+  const tree = join4(at, "tree");
+  const { bytes, files } = copyInto(from, tree, new Set(excluded));
+  const manifests = manifestsUnder2(tree);
+  const record = {
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    bytes,
+    commands: commandsFor(readManifest(join4(tree, "package.json")), manifests, input.named),
+    excluded,
+    files,
+    from,
+    lockfile,
+    manager,
+    manifests,
+    name: input.name
+  };
+  writeFileSync2(join4(at, "snapshot.json"), `${JSON.stringify(record, void 0, 2)}
+`);
+  return record;
+};
+var describeCommand = (command) => {
+  if ("run" in command) return `run ${command.run}`;
+  if ("exec" in command) return command.exec;
+  return `nothing \u2014 ${command.why}`;
+};
+var formatSnapshot = (record) => [
+  `OK    snapshot ${record.name}: ${record.files} files, ${record.bytes} bytes, ${record.manifests.length} manifests
+`,
+  `      from ${record.from} \u2014 ${record.manager} (${record.lockfile})
+`,
+  ...PHASES.map((phase) => `      ${phase}: ${describeCommand(record.commands[phase])}
+`)
+].join("");
+
+// src/envelope.ts
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname2, join as join5 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+var ENVELOPES_DIR = ".geonosis/envelopes";
+var envelopePath = (root, tool) => join5(root, ENVELOPES_DIR, `${tool}.json`);
+var UnbalancedEnvelope = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "UnbalancedEnvelope";
+  }
+};
+var isCount = (value2) => Number.isSafeInteger(value2) && value2 >= 0;
+var unbalancedMessage = (envelope, next) => `${envelope.tool}: considered ${envelope.considered} but accounts for ${envelope.read + envelope.refused.length + envelope.excused.length} \u2014 ${envelope.read} read + ${envelope.refused.length} refused + ${envelope.excused.length} excused. A run that has lost count of its own inputs cannot say what it measured, so no verdict was rendered and no envelope was written. Next: ${next}`;
+var writeEnvelope = ({
+  envelope,
+  next,
+  root
+}) => {
+  if (envelope.tool.trim() === "") {
+    throw new UnbalancedEnvelope(
+      `an envelope with no tool name cannot be filed or reported against. Next: ${next}`
+    );
+  }
+  if (envelope.version.trim() === "") {
+    throw new UnbalancedEnvelope(
+      `${envelope.tool}: an envelope that cannot name the build that wrote it dates nothing, and a stale one reads exactly like a fresh one. Next: ${next}`
+    );
+  }
+  if (!isCount(envelope.considered) || !isCount(envelope.read)) {
+    throw new UnbalancedEnvelope(
+      `${envelope.tool}: considered ${envelope.considered} and read ${envelope.read} \u2014 a census is a whole number of things, and arithmetic over anything else balances by accident. Next: ${next}`
+    );
+  }
+  if (envelope.considered !== envelope.read + envelope.refused.length + envelope.excused.length) {
+    throw new UnbalancedEnvelope(unbalancedMessage(envelope, next));
+  }
+  const at = envelopePath(root, envelope.tool);
+  mkdirSync2(dirname2(at), { recursive: true });
+  writeFileSync3(at, `${JSON.stringify(envelope, void 0, 2)}
+`);
+  return at;
+};
+var UNKNOWN = "unknown";
+var versionIn = (dir) => {
+  try {
+    const manifest = JSON.parse(readFileSync8(join5(dir, "package.json"), "utf8"));
+    return typeof manifest.version === "string" ? manifest.version : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var versionOf = (moduleUrl) => {
+  let dir = dirname2(fileURLToPath3(moduleUrl));
+  for (; ; ) {
+    const found = versionIn(dir);
+    if (found !== void 0) return found;
+    const up = dirname2(dir);
+    if (up === dir) return UNKNOWN;
+    dir = up;
+  }
+};
+var MIGRATIONS_TOOL = "release-migrations";
+var MIGRATIONS_NEXT = "geonosis-release migrations --since <ref> --json and compare `files` against `unreadable` \u2014 every added file leaves by exactly one door, and a file in one list and not the other is the accounting bug this refuses over";
+var migrationsEnvelope = (report, durationMs) => ({
+  considered: report.files.length,
+  durationMs,
+  excused: report.files.filter((one) => one.state === "excused").map((one) => ({
+    path: one.path,
+    reason: "a contract-migration marker this gate could believe"
+  })),
+  findings: [...report.refusals, ...report.markers, ...report.squawk],
+  read: report.files.filter((one) => one.state !== "excused" && one.state !== "unreadable").length,
+  refused: report.unreadable.map((one) => ({ path: one.path, reason: one.why })),
+  tool: MIGRATIONS_TOOL,
+  version: versionOf(import.meta.url)
+});
+var SCHEMA_TOOL = "release-schema";
+var SCHEMA_NEXT = "geonosis-release schema --json and compare `files` against `unreadable` \u2014 the denominator is every migration under every declared domain directory, and a file in neither list is one nothing read (#168)";
+var schemaEnvelope = (report, durationMs) => ({
+  considered: report.files.length,
+  durationMs,
+  excused: [],
+  findings: report.findings,
+  read: report.read,
+  refused: report.unreadable.map((one) => ({ path: one.path, reason: one.why })),
+  tool: SCHEMA_TOOL,
+  version: versionOf(import.meta.url)
+});
+var PUBLISHED_TOOL = "release-published";
+var PUBLISHED_NEXT = "geonosis-release published --group --json and compare `considered` against `lines` + `excused` \u2014 every manifest in the tree leaves by exactly one door, and a group announced off a sample is the failure this counts against (#147)";
+var publishedEnvelope = (report, durationMs) => ({
+  considered: report.considered,
+  durationMs,
+  excused: report.excused,
+  findings: report.lines.filter((one) => one.verdict !== "MATCH"),
+  read: report.lines.filter((one) => one.verdict !== "UNREACHABLE").length,
+  refused: report.lines.filter((one) => one.verdict === "UNREACHABLE").map((one) => ({ path: one.at, reason: one.why })),
+  tool: PUBLISHED_TOOL,
+  version: versionOf(import.meta.url)
+});
+
+// src/smoke-run.ts
+import { spawnSync as spawnSync4 } from "child_process";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readdirSync as readdirSync4, readFileSync as readFileSync9, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join6, relative as relative4, resolve as resolve8 } from "path";
+var BASELINE_FILE = "baseline.json";
+var INSTALL = {
+  bun: ["install"],
+  pnpm: ["install", "--no-frozen-lockfile"]
+};
+var isRecord5 = (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+var readJson = (path) => {
+  try {
+    return JSON.parse(readFileSync9(path, "utf8"));
+  } catch (error) {
+    throw new CannotRun(`${path} is not readable JSON: ${error.message}`);
+  }
+};
+var packRc = (rc, into) => {
+  if (!existsSync6(join6(rc, "package.json"))) {
+    throw new CannotRun(`${rc} has no package.json \u2014 that is not a workspace to pack`);
+  }
+  mkdirSync3(into, { recursive: true });
+  const root = readJson(join6(rc, "package.json"));
+  const isPrivateRoot = isRecord5(root) && root["private"] === true;
+  const done = spawnSync4(
+    "pnpm",
+    [
+      "pack",
+      "--recursive",
+      ...isPrivateRoot ? ["--filter", "!."] : [],
+      "--pack-destination",
+      into,
+      "--json"
+    ],
+    { cwd: rc, encoding: "utf8" }
+  );
+  if (done.error !== void 0) {
+    throw new CannotRun(`pnpm pack could not be run in ${rc}: ${done.error.message}`);
+  }
+  if (done.status !== 0) {
+    throw new CannotRun(
+      `pnpm pack exited ${done.status ?? -1} in ${rc} \u2014 nothing was installed anywhere:
+${(done.stdout + done.stderr).trim()}`
+    );
+  }
+  const parsed = JSON.parse(done.stdout.slice(done.stdout.search(/[[{]/)));
+  const entries = Array.isArray(parsed) ? parsed : [parsed];
+  return entries.map((one) => ({
+    files: (one.files ?? []).map((file) => file.path),
+    name: one.name,
+    tarball: one.filename,
+    version: one.version
+  }));
+};
+var declaredTypes = (manifest) => {
+  const found = [];
+  const walk = (value2) => {
+    if (!isRecord5(value2)) return;
+    const types = value2["types"];
+    if (typeof types === "string") found.push(types);
+    for (const one of Object.values(value2)) walk(one);
+  };
+  walk({ exports: manifest["exports"], types: manifest["types"] });
+  return [...new Set(found.map((one) => one.replace(/^\.\//, "")))];
+};
+var sourceManifests = (rc) => {
+  const excluded = new Set(EXCLUDED_DIRS);
+  const found = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync4(dir, { withFileTypes: true })) {
+      if (excluded.has(entry.name)) continue;
+      if (entry.isDirectory()) {
+        walk(join6(dir, entry.name));
+        continue;
+      }
+      if (entry.name !== "package.json") continue;
+      const manifest = readJson(join6(dir, entry.name));
+      if (!isRecord5(manifest) || typeof manifest["name"] !== "string") continue;
+      found.push({ manifest, name: manifest["name"] });
+    }
+  };
+  walk(rc);
+  return found;
+};
+var promisedButNotPacked = (rc, packed) => {
+  const manifests = new Map(sourceManifests(rc).map((one) => [one.name, one.manifest]));
+  return packed.flatMap((one) => {
+    const manifest = manifests.get(one.name);
+    if (manifest === void 0) return [];
+    return declaredTypes(manifest).filter((path) => !one.files.includes(path)).map(
+      (path) => `${one.name}@${one.version}: the manifest promises ${path} and the tarball does not carry it`
+    );
+  });
+};
+var OVERRIDES = "overrides:";
+var TOP_LEVEL = /^\S/;
+var KEYED = /^\s+["']?(.+?)["']?\s*:/;
+var pinsInWorkspaceYaml = (work, pins) => {
+  const at = join6(work, "pnpm-workspace.yaml");
+  const written = Object.entries(pins).map(([name, spec]) => `  '${name}': '${spec}'`);
+  const lines2 = existsSync6(at) ? readFileSync9(at, "utf8").split("\n") : [];
+  const kept = [];
+  let inside = false;
+  let found = false;
+  for (const line of lines2) {
+    if (TOP_LEVEL.test(line)) inside = line.startsWith(OVERRIDES);
+    if (inside && line.startsWith(OVERRIDES)) {
+      kept.push(line, ...written);
+      found = true;
+      continue;
+    }
+    const key = inside ? KEYED.exec(line)?.[1] : void 0;
+    if (key !== void 0 && pins[key] !== void 0) continue;
+    kept.push(line);
+  }
+  const body = found ? kept : [...kept, OVERRIDES, ...written, ""];
+  writeFileSync4(at, body.join("\n"));
+};
+var pinsInManifest = (work, pins) => {
+  const at = join6(work, "package.json");
+  if (!existsSync6(at)) return;
+  const manifest = readJson(at);
+  if (!isRecord5(manifest)) return;
+  manifest["overrides"] = {
+    ...isRecord5(manifest["overrides"]) ? manifest["overrides"] : {},
+    ...pins
+  };
+  writeFileSync4(at, `${JSON.stringify(manifest, void 0, 2)}
+`);
+};
+var overrideEveryCopy = (work, manager, packed) => {
+  if (packed.length === 0) return;
+  const pins = Object.fromEntries(packed.map((one) => [one.name, `file:${one.tarball}`]));
+  if (manager === "pnpm") pinsInWorkspaceYaml(work, pins);
+  else pinsInManifest(work, pins);
+};
+var rewriteManifests = (tree, manifests, packed) => {
+  const byName = new Map(packed.map((one) => [one.name, one.tarball]));
+  const swapped = [];
+  for (const path of manifests) {
+    const at = join6(tree, path);
+    if (!existsSync6(at)) continue;
+    const manifest = readJson(at);
+    if (!isRecord5(manifest)) continue;
+    let touched = false;
+    for (const key of ["dependencies", "devDependencies"]) {
+      const block = manifest[key];
+      if (!isRecord5(block)) continue;
+      for (const name of Object.keys(block)) {
+        const tarball = byName.get(name);
+        if (tarball === void 0) continue;
+        block[name] = `file:${tarball}`;
+        swapped.push({ name, path });
+        touched = true;
+      }
+    }
+    if (touched) writeFileSync4(at, `${JSON.stringify(manifest, void 0, 2)}
+`);
+  }
+  return swapped;
+};
+var shellRun = (command, cwd, env) => {
+  const done = spawnSync4(command, { cwd, encoding: "utf8", env, shell: true });
+  return { code: done.status ?? -1, output: `${done.stdout ?? ""}${done.stderr ?? ""}` };
+};
+var INTERESTING = /\b(error|Error|ERROR|FAIL|failed|refused|✗|✘)\b/;
+var quotable = (output) => {
+  const lines2 = output.split("\n").map((one) => one.trimEnd()).filter((one) => one.trim() !== "");
+  const named = lines2.filter((one) => INTERESTING.test(one));
+  return (named.length > 0 ? named : lines2.slice(-10)).slice(0, 20).map((one) => one.slice(0, 300));
+};
+var commandLine = (command, manager) => "run" in command ? `${manager} run ${command.run}` : "exec" in command ? command.exec : "";
+var runPhase = (phase, command, cwd, manager) => {
+  if ("why" in command) return { phase, why: command.why };
+  const line = commandLine(command, manager);
+  const env = {
+    ...process.env,
+    PATH: `${join6(cwd, "node_modules/.bin")}:${process.env["PATH"] ?? ""}`
+  };
+  const { code, output } = shellRun(line, cwd, env);
+  return { code, command: line, lines: quotable(output), ok: code === 0, phase };
+};
+var smokeOver = (input) => {
+  const record = readSnapshot(input.root, input.name);
+  const at = snapshotDir(input.root, input.name);
+  const work = join6(at, "run");
+  rmSync3(work, { force: true, recursive: true });
+  copyInto(join6(at, "tree"), work, new Set(EXCLUDED_DIRS));
+  ownRepository(work);
+  const packed = input.rc === void 0 ? [] : packRc(resolve8(input.rc), join6(at, "rc"));
+  const findings = input.rc === void 0 ? [] : promisedButNotPacked(resolve8(input.rc), packed);
+  const swapped = rewriteManifests(
+    work,
+    record.manifests.map((one) => one.path),
+    packed
+  );
+  if (input.rc !== void 0 && swapped.length === 0) {
+    throw new CannotRun(
+      `no manifest in "${input.name}" depends on anything ${input.rc} packs \u2014 this run would have installed the published versions and called them the release candidate`
+    );
+  }
+  overrideEveryCopy(work, record.manager, packed);
+  const install = input.install ?? `${record.manager} ${INSTALL[record.manager].join(" ")}`;
+  const installed = shellRun(install, work, process.env);
+  if (installed.code !== 0) {
+    throw new CannotRun(
+      `\`${install}\` exited ${installed.code} in the snapshot \u2014 the release was never installed, so nothing below it was measured:
+${quotable(installed.output).join("\n")}`
+    );
+  }
+  return {
+    findings,
+    outcomes: PHASES.map((phase) => runPhase(phase, record.commands[phase], work, record.manager)),
+    packed
+  };
+};
+var ownRepository = (work) => {
+  const done = spawnSync4("git", ["init", "-q"], { cwd: work });
+  if (done.error !== void 0 || done.status !== 0) {
+    throw new CannotRun(
+      `git init failed in ${work} \u2014 without a repository of its own, this copy's install would find the repository this tool is running inside and write into it: ${done.error?.message ?? done.stderr}`
+    );
+  }
+};
+var baselinePath = (root, name) => join6(snapshotDir(root, name), BASELINE_FILE);
+var recordBaseline = (input) => {
+  const { outcomes, packed } = smokeOver(input);
+  const baseline = {
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    packed: packed.map((one) => ({ name: one.name, version: one.version })),
+    phases: outcomes,
+    rc: input.rc === void 0 ? "the versions the tree names" : resolve8(input.rc)
+  };
+  writeFileSync4(baselinePath(input.root, input.name), `${JSON.stringify(baseline, void 0, 2)}
+`);
+  return baseline;
+};
+var readBaseline = (root, name) => {
+  const at = baselinePath(root, name);
+  if (!existsSync6(at)) {
+    throw new CannotRun(
+      `"${name}" has no baseline \u2014 a run that took its own answer as the standard would certify anything. Record one against the versions this consumer is on: geonosis-release smoke baseline --snapshot ${name}`
+    );
+  }
+  return readJson(at);
+};
+var compareToBaseline = (name, baseline, outcomes, findings) => {
+  const before = new Map(baseline.phases.map((one) => [one.phase, one]));
+  const broken = [];
+  const known = [];
+  const mended = [];
+  const refused = [];
+  for (const now of outcomes) {
+    const then = before.get(now.phase);
+    if (then === void 0) {
+      refused.push({
+        phase: now.phase,
+        why: "the baseline never considered this phase, so there is nothing to compare it against"
+      });
+      continue;
+    }
+    if ("why" in now) continue;
+    if ("why" in then) {
+      refused.push({
+        phase: now.phase,
+        why: `the baseline excused this phase (${then.why}) and this run ran it \u2014 the two are not comparable`
+      });
+      continue;
+    }
+    if (now.code < 0) {
+      refused.push({ phase: now.phase, why: `\`${now.command}\` could not be run at all` });
+      continue;
+    }
+    if (!now.ok && then.ok) broken.push({ lines: now.lines, phase: now.phase });
+    if (!now.ok && !then.ok) known.push(now.phase);
+    if (now.ok && !then.ok) mended.push(now.phase);
+  }
+  return {
+    broken,
+    findings,
+    known,
+    mended,
+    name,
+    ok: broken.length === 0 && findings.length === 0,
+    outcomes,
+    refused
+  };
+};
+var runSmoke = (input) => {
+  const baseline = readBaseline(input.root, input.name);
+  const { findings, outcomes } = smokeOver(input);
+  return compareToBaseline(input.name, baseline, outcomes, findings);
+};
+var sweepSmoke = (input) => {
+  const comparisons = [];
+  const skipped = [];
+  for (const one of input.wanted) {
+    if (input.skipMissing && !existsSync6(join6(snapshotDir(input.root, one.name), "snapshot.json"))) {
+      skipped.push({
+        name: one.name,
+        why: `no snapshot of it here \u2014 record one with: geonosis-release smoke snapshot ${one.name} --from <their tree>`
+      });
+      continue;
+    }
+    comparisons.push(
+      runSmoke({
+        ...one.install === void 0 ? {} : { install: one.install },
+        name: one.name,
+        ...input.rc === void 0 ? {} : { rc: input.rc },
+        root: input.root
+      })
+    );
+  }
+  return { comparisons, skipped };
+};
+var formatSweep = (sweep) => [
+  ...sweep.comparisons.map(formatSmoke),
+  ...sweep.skipped.map((one) => `SKIP  smoke ${one.name}: ${one.why}
+`)
+].join("");
+var sweepEnvelope = (sweep, durationMs) => {
+  const parts = sweep.comparisons.map((one) => smokeEnvelope(one, 0));
+  return {
+    considered: parts.reduce((sum, one) => sum + one.considered, 0) + sweep.skipped.length * 3,
+    durationMs,
+    excused: [
+      ...parts.flatMap(
+        (one, index) => one.excused.map((entry) => ({
+          path: `${sweep.comparisons[index]?.name ?? ""}/${entry.path}`,
+          reason: entry.reason
+        }))
+      ),
+      ...sweep.skipped.flatMap(
+        (one) => PHASES.map((phase) => ({ path: `${one.name}/${phase}`, reason: one.why }))
+      )
+    ],
+    findings: parts.flatMap((one) => one.findings),
+    read: parts.reduce((sum, one) => sum + one.read, 0),
+    refused: parts.flatMap(
+      (one, index) => one.refused.map((entry) => ({
+        path: `${sweep.comparisons[index]?.name ?? ""}/${entry.path}`,
+        reason: entry.reason
+      }))
+    ),
+    tool: SMOKE_TOOL,
+    version: versionOf(import.meta.url)
+  };
+};
+var outcomeLine = (outcome) => "why" in outcome ? `      ${outcome.phase}: nothing to run \u2014 ${outcome.why}
+` : `      ${outcome.phase}: \`${outcome.command}\` exited ${outcome.code}
+`;
+var headline = (comparison) => {
+  if (comparison.ok) {
+    return `OK    smoke ${comparison.name}: nothing this release changed reddened their tree
+`;
+  }
+  if (comparison.broken.length === 0) {
+    return `FAIL  smoke ${comparison.name}: their gates are unmoved, and this release ships ${comparison.findings.length} promise(s) its tarballs do not carry
+`;
+  }
+  return `FAIL  smoke ${comparison.name}: the release broke ${comparison.broken.length} of their gates
+`;
+};
+var formatSmoke = (comparison) => [
+  headline(comparison),
+  ...comparison.outcomes.map(outcomeLine),
+  ...comparison.broken.flatMap((one) => [
+    `  ${one.phase} passed at the versions they are on and fails under this release:
+`,
+    ...one.lines.map((line) => `    ${line}
+`)
+  ]),
+  ...comparison.findings.map((one) => `  packed: ${one}
+`),
+  ...comparison.known.map(
+    (one) => `  ${one} was already failing at their versions \u2014 not this release's doing
+`
+  ),
+  ...comparison.mended.map(
+    (one) => `  ${one} was failing at their versions and passes under this release
+`
+  ),
+  ...comparison.refused.map((one) => `  ${one.phase} could not be compared: ${one.why}
+`)
+].join("");
+var formatBaseline = (name, baseline) => [
+  `OK    baseline ${name}: recorded against ${baseline.rc}
+`,
+  ...baseline.phases.map(outcomeLine)
+].join("");
+var SMOKE_TOOL = "release-smoke";
+var SMOKE_NEXT = "geonosis-release smoke run --snapshot <name> --json and read `outcomes` \u2014 every phase the snapshot named leaves by exactly one door: read, excused with the sentence saying there was nothing of theirs to run, or refused because this run and the baseline are not comparable";
+var smokeEnvelope = (comparison, durationMs) => {
+  const refused = new Set(comparison.refused.map((one) => one.phase));
+  const excused = comparison.outcomes.filter(
+    (one) => "why" in one && !refused.has(one.phase)
+  );
+  return {
+    considered: comparison.outcomes.length,
+    durationMs,
+    excused: excused.map((one) => ({ path: one.phase, reason: one.why })),
+    findings: [
+      ...comparison.broken.map((one) => ({ lines: one.lines, phase: one.phase })),
+      ...comparison.findings.map((one) => ({ packed: one }))
+    ],
+    read: comparison.outcomes.length - excused.length - comparison.refused.length,
+    refused: comparison.refused.map((one) => ({ path: one.phase, reason: one.why })),
+    tool: SMOKE_TOOL,
+    version: versionOf(import.meta.url)
+  };
+};
+
+export {
+  CannotRun,
+  parseReleaseConfig,
+  readReleaseConfig,
+  parseJsonc,
+  parseToml,
+  declaredIn,
+  readWrangler,
+  DEPLOYED_FILE,
+  NOTHING_SAYS,
+  readDeployed,
+  driftBetween,
+  runDeployed,
+  formatDeployed,
+  markersIn,
+  addSqlIn,
+  NARROWING,
+  statementsOf,
+  refusalsIn,
+  runMigrations,
+  formatMigrations,
+  STEPS,
+  WHY_VERSION_IDENTITY,
+  runPlan,
+  formatPlan,
+  Runner,
+  proveOver,
+  PLANTS,
+  prove,
+  formatProve,
+  formatVerdict,
+  DEFAULT_REGISTRY,
+  registryPathOf,
+  askRegistry,
+  censusOf,
+  EXISTS_BUT,
+  runPublished,
+  formatPublished,
+  runSchema,
+  formatSchema,
+  SNAPSHOTS_DIR,
+  EXCLUDED_DIRS,
+  PHASES,
+  snapshotDir,
+  readSnapshot,
+  runSnapshot,
+  formatSnapshot,
+  writeEnvelope,
+  MIGRATIONS_NEXT,
+  migrationsEnvelope,
+  SCHEMA_NEXT,
+  schemaEnvelope,
+  PUBLISHED_NEXT,
+  publishedEnvelope,
+  BASELINE_FILE,
+  packRc,
+  promisedButNotPacked,
+  rewriteManifests,
+  recordBaseline,
+  readBaseline,
+  compareToBaseline,
+  runSmoke,
+  sweepSmoke,
+  formatSweep,
+  sweepEnvelope,
+  formatSmoke,
+  formatBaseline,
+  SMOKE_TOOL,
+  SMOKE_NEXT,
+  smokeEnvelope
+};