@geonosis/release 2.0.0 → 2.1.0

package/dist/{chunk-KQIWTXQP.js → chunk-MZWAN6WT.js}

@@ -95,12 +95,41 @@ var parseSchema = (value2) => {
   };
 };
 var SMOKE_KEYS = "expected { exclude?, snapshots? }";
+var SNAPSHOT_KEYS = "expected { commands?, install?, name }";
+var SMOKE_PHASES = ["doctor", "lint", "typecheck"];
+var parseCommands = (value2, at) => {
+  if (value2 === void 0) return {};
+  if (!isRecord(value2)) {
+    throw new CannotRun(
+      `${at}.commands must be an object \u2014 expected { doctor?, lint?, typecheck? }`
+    );
+  }
+  const unknown = Object.keys(value2).find(
+    (key) => !SMOKE_PHASES.includes(key)
+  );
+  if (unknown !== void 0) {
+    throw new CannotRun(
+      `${at}.commands.${unknown} is not a phase the smoke runs \u2014 it runs ${SMOKE_PHASES.join(", ")}`
+    );
+  }
+  const commands = {};
+  for (const phase of SMOKE_PHASES) {
+    const command = value2[phase];
+    if (command === void 0) continue;
+    if (typeof command !== "string" || command === "") {
+      throw new CannotRun(`${at}.commands.${phase} must be the command that runs their ${phase}`);
+    }
+    commands[phase] = command;
+  }
+  return commands;
+};
 var oneSnapshot = (value2, index) => {
   const at = `release.smoke.snapshots[${index}]`;
-  if (!isRecord(value2)) throw new CannotRun(`${at} must be an object \u2014 expected { name, install? }`);
-  const unknown = Object.keys(value2).find((key) => key !== "install" && key !== "name");
+  if (!isRecord(value2)) throw new CannotRun(`${at} must be an object \u2014 ${SNAPSHOT_KEYS}`);
+  const known = /* @__PURE__ */ new Set(["commands", "install", "name"]);
+  const unknown = Object.keys(value2).find((key) => !known.has(key));
   if (unknown !== void 0) {
-    throw new CannotRun(`${at}.${unknown} is not a key it takes \u2014 expected { name, install? }`);
+    throw new CannotRun(`${at}.${unknown} is not a key it takes \u2014 ${SNAPSHOT_KEYS}`);
   }
   const name = value2["name"];
   if (typeof name !== "string" || name === "") {
@@ -110,7 +139,11 @@ var oneSnapshot = (value2, index) => {
   if (install !== void 0 && typeof install !== "string") {
     throw new CannotRun(`${at}.install must be the command that installs that tree`);
   }
-  return { ...install === void 0 ? {} : { install }, name };
+  return {
+    commands: parseCommands(value2["commands"], at),
+    ...install === void 0 ? {} : { install },
+    name
+  };
 };
 var parseSmoke = (value2) => {
   if (value2 === void 0) return { exclude: [], snapshots: [] };
@@ -121,7 +154,7 @@ var parseSmoke = (value2) => {
   }
   const snapshots = value2["snapshots"];
   if (snapshots !== void 0 && !Array.isArray(snapshots)) {
-    throw new CannotRun("release.smoke.snapshots must be a list of { name, install? }");
+    throw new CannotRun(`release.smoke.snapshots must be a list \u2014 ${SNAPSHOT_KEYS}, per entry`);
   }
   return {
     exclude: strings(value2["exclude"], "release.smoke.exclude"),
@@ -175,238 +208,905 @@ var readReleaseConfig = (root) => {
   }
 };
 
-// src/wrangler.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { resolve as resolve2 } from "path";
-var isRecord2 = (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
-var parseJsonc = (source) => {
-  let out = "";
-  for (let index = 0; index < source.length; index += 1) {
-    const char = source[index] ?? "";
-    if (char === '"') {
-      const start = index;
-      index += 1;
-      for (; index < source.length; index += 1) {
-        if (source[index] === "\\") {
-          index += 1;
-          continue;
-        }
-        if (source[index] === '"') break;
-      }
-      out += source.slice(start, index + 1);
-      continue;
-    }
-    if (char === "/" && source[index + 1] === "/") {
-      const end = source.indexOf("\n", index);
-      index = end === -1 ? source.length : end - 1;
-      continue;
-    }
-    if (char === "/" && source[index + 1] === "*") {
-      const end = source.indexOf("*/", index + 2);
-      index = end === -1 ? source.length : end + 1;
-      continue;
-    }
-    out += char;
-  }
-  return JSON.parse(out.replaceAll(/,(\s*[\]}])/g, "$1"));
-};
-var literal = (text) => {
-  const value2 = text.trim();
-  if (value2.startsWith('"') || value2.startsWith("'")) return value2.slice(1, -1);
-  if (value2 === "true") return true;
-  if (value2 === "false") return false;
-  const number = Number(value2);
-  return Number.isNaN(number) ? value2 : number;
-};
-var split = (text, delimiter) => {
-  const parts = [];
-  let depth = 0;
-  let quote = "";
-  let current = "";
-  for (const char of text) {
-    if (quote !== "") {
-      current += char;
-      if (char === quote) quote = "";
-      continue;
-    }
-    if (char === '"' || char === "'") quote = char;
-    if (char === "[" || char === "{") depth += 1;
-    if (char === "]" || char === "}") depth -= 1;
-    if (char === delimiter && depth === 0) {
-      parts.push(current);
-      current = "";
-      continue;
-    }
-    current += char;
+// src/envelope.ts
+import { mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+var ENVELOPES_DIR = ".geonosis/envelopes";
+var envelopePath = (root, tool) => join(root, ENVELOPES_DIR, `${tool}.json`);
+var UnbalancedEnvelope = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "UnbalancedEnvelope";
   }
-  parts.push(current);
-  return parts.filter((one) => one.trim() !== "");
 };
-var value = (text) => {
-  const trimmed = text.trim();
-  if (trimmed.startsWith("[")) return split(trimmed.slice(1, -1), ",").map(value);
-  if (trimmed.startsWith("{")) {
-    return Object.fromEntries(
-      split(trimmed.slice(1, -1), ",").map((pair) => {
-        const at = pair.indexOf("=");
-        return [pair.slice(0, at).trim(), value(pair.slice(at + 1))];
-      })
+var isCount = (value2) => Number.isSafeInteger(value2) && value2 >= 0;
+var unbalancedMessage = (envelope, next) => `${envelope.tool}: considered ${envelope.considered} but accounts for ${envelope.read + envelope.refused.length + envelope.excused.length} \u2014 ${envelope.read} read + ${envelope.refused.length} refused + ${envelope.excused.length} excused. A run that has lost count of its own inputs cannot say what it measured, so no verdict was rendered and no envelope was written. Next: ${next}`;
+var writeEnvelope = ({
+  envelope,
+  next,
+  root
+}) => {
+  if (envelope.tool.trim() === "") {
+    throw new UnbalancedEnvelope(
+      `an envelope with no tool name cannot be filed or reported against. Next: ${next}`
     );
   }
-  return literal(trimmed);
-};
-var put = (into, path, leaf) => {
-  let here = into;
-  for (const key of path.slice(0, -1)) {
-    if (!isRecord2(here[key])) here[key] = {};
-    here = here[key];
-  }
-  here[path.at(-1) ?? ""] = leaf;
-};
-var table = (into, path) => {
-  let here = into;
-  for (const key of path) {
-    if (!isRecord2(here[key])) here[key] = {};
-    here = here[key];
+  if (envelope.version.trim() === "") {
+    throw new UnbalancedEnvelope(
+      `${envelope.tool}: an envelope that cannot name the build that wrote it dates nothing, and a stale one reads exactly like a fresh one. Next: ${next}`
+    );
   }
-  return here;
-};
-var arrayTable = (into, path) => {
-  let here = into;
-  for (const key of path.slice(0, -1)) {
-    if (!isRecord2(here[key])) here[key] = {};
-    here = here[key];
+  if (!isCount(envelope.considered) || !isCount(envelope.read)) {
+    throw new UnbalancedEnvelope(
+      `${envelope.tool}: considered ${envelope.considered} and read ${envelope.read} \u2014 a census is a whole number of things, and arithmetic over anything else balances by accident. Next: ${next}`
+    );
   }
-  const last = path.at(-1) ?? "";
-  if (!Array.isArray(here[last])) here[last] = [];
-  const list = here[last];
-  const entry = {};
-  list.push(entry);
-  return entry;
-};
-var parseToml = (source) => {
-  const out = {};
-  let here = out;
-  const lines2 = source.split("\n");
-  for (let index = 0; index < lines2.length; index += 1) {
-    const line = (lines2[index] ?? "").split("#")[0]?.trim() ?? "";
-    if (line === "") continue;
-    if (line.startsWith("[[") && line.endsWith("]]")) {
-      here = arrayTable(out, line.slice(2, -2).trim().split("."));
-      continue;
-    }
-    if (line.startsWith("[") && line.endsWith("]")) {
-      here = table(out, line.slice(1, -1).trim().split("."));
-      continue;
-    }
-    const at = line.indexOf("=");
-    if (at === -1) continue;
-    let text = line.slice(at + 1);
-    while ([...text].filter((one) => one === "[").length > [...text].filter((one) => one === "]").length) {
-      index += 1;
-      if (index >= lines2.length) throw new CannotRun("an unterminated array in the TOML config");
-      text += `
-${(lines2[index] ?? "").split("#")[0] ?? ""}`;
-    }
-    put(here, line.slice(0, at).trim().split("."), value(text));
+  if (envelope.considered !== envelope.read + envelope.refused.length + envelope.excused.length) {
+    throw new UnbalancedEnvelope(unbalancedMessage(envelope, next));
   }
-  return out;
-};
-var BINDING_LISTS = [
-  "ai",
-  "analytics_engine_datasets",
-  "browser",
-  "d1_databases",
-  "dispatch_namespaces",
-  "durable_objects",
-  "hyperdrive",
-  "kv_namespaces",
-  "mtls_certificates",
-  "queues",
-  "r2_buckets",
-  "send_email",
-  "services",
-  "vectorize",
-  "version_metadata",
-  "workflows"
-];
-var bindingsOf = (found) => {
-  if (Array.isArray(found)) return found.flatMap(bindingsOf);
-  if (!isRecord2(found)) return [];
-  const named = found["binding"] ?? found["name"];
-  const here = typeof named === "string" ? [named] : [];
-  const nested = Object.entries(found).filter(([key]) => key === "bindings" || key === "producers" || key === "consumers").flatMap(([, one]) => bindingsOf(one));
-  return [...here, ...nested];
-};
-var declaredIn = (config) => {
-  const triggers = config["triggers"];
-  const crons = isRecord2(triggers) && Array.isArray(triggers["crons"]) ? triggers["crons"] : [];
-  const routes = config["routes"];
-  const one = config["route"];
-  const listed = [
-    ...Array.isArray(routes) ? routes : [],
-    ...typeof one === "string" ? [one] : []
-  ];
-  return {
-    bindings: BINDING_LISTS.flatMap((key) => bindingsOf(config[key])).toSorted(),
-    crons: crons.filter((cron) => typeof cron === "string").toSorted(),
-    routes: listed.map((route) => isRecord2(route) ? route["pattern"] : route).filter((pattern) => typeof pattern === "string").toSorted()
-  };
+  const at = envelopePath(root, envelope.tool);
+  mkdirSync(dirname(at), { recursive: true });
+  writeFileSync(at, `${JSON.stringify(envelope, void 0, 2)}
+`);
+  return at;
 };
-var readWrangler = (root, relative5, env) => {
-  const path = resolve2(root, relative5);
-  let parsed;
+var UNKNOWN = "unknown";
+var versionIn = (dir) => {
   try {
-    const source = readFileSync2(path, "utf8");
-    parsed = relative5.endsWith(".toml") ? parseToml(source) : parseJsonc(source);
-  } catch (error) {
-    throw new CannotRun(`${relative5} could not be read: ${error.message}`);
+    const manifest = JSON.parse(readFileSync2(join(dir, "package.json"), "utf8"));
+    return typeof manifest.version === "string" ? manifest.version : void 0;
+  } catch {
+    return void 0;
   }
-  if (!isRecord2(parsed)) throw new CannotRun(`${relative5} is not a wrangler configuration`);
-  const environments = parsed["env"];
-  const block = env !== void 0 && isRecord2(environments) && isRecord2(environments[env]) ? environments[env] : parsed;
-  return declaredIn(block);
 };
-
-// src/deployed.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
-import { resolve as resolve3 } from "path";
-var DEPLOYED_FILE = ".geonosis/deployed.json";
-var NOTHING_SAYS = "nothing here says what is deployed \u2014 .geonosis/deployed.json is written by the pipeline after promote, and its absence is not a pass";
-var listOf = (found) => Array.isArray(found) ? found.filter((one) => typeof one === "string") : [];
-var isRecord3 = (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
-var readDeployed = (root) => {
-  const path = resolve3(root, DEPLOYED_FILE);
-  if (!existsSync2(path)) throw new CannotRun(NOTHING_SAYS);
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync3(path, "utf8"));
-  } catch (error) {
-    throw new CannotRun(`${DEPLOYED_FILE} is not readable JSON: ${error.message}`);
+var versionOf = (moduleUrl) => {
+  let dir = dirname(fileURLToPath(moduleUrl));
+  for (; ; ) {
+    const found = versionIn(dir);
+    if (found !== void 0) return found;
+    const up = dirname(dir);
+    if (up === dir) return UNKNOWN;
+    dir = up;
   }
-  if (!isRecord3(parsed)) throw new CannotRun(`${DEPLOYED_FILE} is not an object`);
-  const triggers = isRecord3(parsed["triggers"]) ? parsed["triggers"] : {};
-  return {
-    ...typeof parsed["at"] === "string" ? { at: parsed["at"] } : {},
-    deployed: {
-      bindings: listOf(parsed["bindings"]),
-      crons: listOf(triggers["crons"]),
-      routes: listOf(triggers["routes"]),
-      secrets: listOf(parsed["secrets"])
-    }
-  };
-};
-var missingBetween = (kind, declared, deployed) => {
-  const missing = declared.filter((one) => !deployed.includes(one));
-  const extra = deployed.filter((one) => !declared.includes(one));
-  return missing.length === 0 && extra.length === 0 ? [] : [{ extra, kind, missing }];
 };
-var driftBetween = (declared, deployed) => [
-  ...missingBetween("crons", declared.crons, deployed.crons),
-  ...missingBetween("routes", declared.routes, deployed.routes),
-  ...missingBetween("bindings", declared.bindings, deployed.bindings),
-  ...missingBetween("secrets", declared.secrets, deployed.secrets)
-];
+var MIGRATIONS_TOOL = "release-migrations";
+var MIGRATIONS_NEXT = "geonosis-release migrations --since <ref> --json and compare `files` against `unreadable` \u2014 every added file leaves by exactly one door, and a file in one list and not the other is the accounting bug this refuses over";
+var migrationsEnvelope = (report, durationMs) => ({
+  considered: report.files.length,
+  durationMs,
+  excused: report.files.filter((one) => one.state === "excused").map((one) => ({
+    path: one.path,
+    reason: "a contract-migration marker this gate could believe"
+  })),
+  findings: [...report.refusals, ...report.markers, ...report.squawk],
+  read: report.files.filter((one) => one.state !== "excused" && one.state !== "unreadable").length,
+  refused: report.unreadable.map((one) => ({ path: one.path, reason: one.why })),
+  tool: MIGRATIONS_TOOL,
+  version: versionOf(import.meta.url)
+});
+var SCHEMA_TOOL = "release-schema";
+var SCHEMA_NEXT = "geonosis-release schema --json and compare `files` against `unreadable` \u2014 the denominator is every migration under every declared domain directory, and a file in neither list is one nothing read (#168)";
+var schemaEnvelope = (report, durationMs) => ({
+  considered: report.files.length,
+  durationMs,
+  excused: [],
+  findings: report.findings,
+  read: report.read,
+  refused: report.unreadable.map((one) => ({ path: one.path, reason: one.why })),
+  tool: SCHEMA_TOOL,
+  version: versionOf(import.meta.url)
+});
+var PUBLISHED_TOOL = "release-published";
+var PUBLISHED_NEXT = "geonosis-release published --group --json and compare `considered` against `lines` + `excused` \u2014 every manifest in the tree leaves by exactly one door, and a group announced off a sample is the failure this counts against (#147)";
+var publishedEnvelope = (report, durationMs) => ({
+  considered: report.considered,
+  durationMs,
+  excused: report.excused,
+  findings: report.lines.filter((one) => one.verdict !== "MATCH"),
+  read: report.lines.filter((one) => one.verdict !== "UNREACHABLE").length,
+  refused: report.lines.filter((one) => one.verdict === "UNREACHABLE").map((one) => ({ path: one.at, reason: one.why })),
+  tool: PUBLISHED_TOOL,
+  version: versionOf(import.meta.url)
+});
+
+// src/registry.ts
+var DEFAULT_REGISTRY = "https://registry.npmjs.org";
+var TIMEOUT_MS = 15e3;
+var registryPathOf = (name) => name.startsWith("@") ? `@${encodeURIComponent(name.slice(1))}` : encodeURIComponent(name);
+var versionsIn = (body) => {
+  const versions = body.versions;
+  return typeof versions === "object" && versions !== null ? Object.keys(versions) : [];
+};
+var latestIn = (body) => {
+  const tags = body["dist-tags"];
+  const latest = typeof tags === "object" && tags !== null ? tags.latest : void 0;
+  return typeof latest === "string" ? latest : void 0;
+};
+var askRegistry = async ({
+  name,
+  registry = DEFAULT_REGISTRY,
+  timeoutMs = TIMEOUT_MS
+}) => {
+  const url = `${registry.replace(/\/+$/, "")}/${registryPathOf(name)}`;
+  let response;
+  try {
+    response = await fetch(url, {
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (error) {
+    return { kind: "unreachable", name, why: `GET ${url} \u2014 ${error.message}` };
+  }
+  if (response.status === 404) return { kind: "absent", name };
+  if (!response.ok) {
+    return { kind: "unreachable", name, why: `GET ${url} \u2014 HTTP ${response.status}` };
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (error) {
+    return {
+      kind: "unreachable",
+      name,
+      why: `GET ${url} answered ${response.status} with something that is not JSON \u2014 ${error.message}`
+    };
+  }
+  return { kind: "present", latest: latestIn(body), name, versions: versionsIn(body) };
+};
+
+// src/published.ts
+import { readdirSync, readFileSync as readFileSync3 } from "fs";
+import { join as join2, relative, sep } from "path";
+var NEVER_WALKED = /* @__PURE__ */ new Set(["build", "coverage", "dist", "node_modules", "storybook-static"]);
+var pathOf = (root, path) => relative(root, path).split(sep).join("/");
+var manifestsUnder = (root) => {
+  const found = [];
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (!entry.name.startsWith(".") && !NEVER_WALKED.has(entry.name))
+          walk(join2(dir, entry.name));
+        continue;
+      }
+      if (entry.name === "package.json") found.push(join2(dir, entry.name));
+    }
+  };
+  walk(root);
+  return found;
+};
+var censusOf = (root) => {
+  const excused = [];
+  const locals = [];
+  for (const path of manifestsUnder(root)) {
+    const at = pathOf(root, path);
+    let manifest;
+    try {
+      manifest = JSON.parse(readFileSync3(path, "utf8"));
+    } catch (error) {
+      excused.push({ path: at, reason: `it does not parse: ${error.message}` });
+      continue;
+    }
+    if (manifest.private === true) {
+      excused.push({ path: at, reason: "private: true \u2014 nothing publishes it" });
+      continue;
+    }
+    if (typeof manifest.name !== "string" || manifest.name === "") {
+      excused.push({ path: at, reason: "it names no package" });
+      continue;
+    }
+    if (typeof manifest.version !== "string" || manifest.version === "") {
+      excused.push({ path: at, reason: "it declares no version" });
+      continue;
+    }
+    locals.push({ at, name: manifest.name, version: manifest.version });
+  }
+  return { excused, locals: locals.toSorted((a, b) => a.name.localeCompare(b.name)) };
+};
+var EXISTS_BUT = "exists but no version matching";
+var lineFor = async (local, registry) => {
+  const answer = await askRegistry({ name: local.name, registry });
+  const base = { at: local.at, local: local.version, name: local.name };
+  if (answer.kind === "unreachable") {
+    return { ...base, latest: void 0, verdict: "UNREACHABLE", why: answer.why };
+  }
+  if (answer.kind === "absent") {
+    return {
+      ...base,
+      latest: void 0,
+      verdict: "ABSENT",
+      why: "npm has never heard of this name \u2014 a name published moments ago 404s for a few minutes; --wait <seconds> polls through that window"
+    };
+  }
+  if (answer.latest === local.version) {
+    return { ...base, latest: answer.latest, verdict: "MATCH", why: "on npm" };
+  }
+  return {
+    ...base,
+    latest: answer.latest,
+    verdict: "BEHIND",
+    why: answer.versions.includes(local.version) ? `npm has ${local.version}, and its latest tag is ${answer.latest ?? "nothing"} \u2014 the group has not landed on one version` : `the package ${EXISTS_BUT} ${local.version}; npm answers ${answer.latest ?? "nothing"}. Minutes after a publish, suspect the package manager's manifest cache before the registry`
+  };
+};
+var sleep = (ms) => new Promise((done) => {
+  setTimeout(done, ms);
+});
+var POLL_MS = 5e3;
+var runPublished = async ({
+  pollMs = POLL_MS,
+  registry = DEFAULT_REGISTRY,
+  root,
+  waitSeconds = 0
+}) => {
+  const { excused, locals } = censusOf(root);
+  const startedAt = Date.now();
+  const budgetMs = Math.max(0, waitSeconds * 1e3);
+  let lines2 = [];
+  let sweeps = 0;
+  for (; ; ) {
+    lines2 = [];
+    for (const local of locals) lines2.push(await lineFor(local, registry));
+    sweeps += 1;
+    const settled = lines2.every((one) => one.verdict === "MATCH");
+    const stuck = lines2.some((one) => one.verdict === "UNREACHABLE");
+    const left = budgetMs - (Date.now() - startedAt);
+    if (settled || stuck || left <= 0) break;
+    await sleep(Math.min(pollMs, left));
+  }
+  const unreachable = lines2.filter((one) => one.verdict === "UNREACHABLE").length;
+  return {
+    considered: lines2.length + excused.length,
+    excused: excused.toSorted((a, b) => a.path.localeCompare(b.path)),
+    lines: lines2,
+    ok: lines2.length > 0 && lines2.every((one) => one.verdict === "MATCH"),
+    registry,
+    sweeps,
+    unreachable,
+    waitedMs: Date.now() - startedAt
+  };
+};
+var NOTHING_TO_CHECK = "published FAIL \u2014 no workspace in this tree declares a package a publish could be about, and a check that considered nothing has not passed";
+var formatPublished = (report) => {
+  const width = Math.max(1, ...report.lines.map((one) => one.name.length));
+  const body = report.lines.map((one) => `  ${one.verdict.padEnd(11)} ${one.name.padEnd(width)} ${one.local}  ${one.why}`).join("\n");
+  const head = report.lines.length === 0 ? NOTHING_TO_CHECK : `published ${report.ok ? "PASS" : "FAIL"} \u2014 ${report.lines.filter((one) => one.verdict === "MATCH").length}/${report.lines.length} of the group on ${report.registry}`;
+  const tail = [
+    `considered ${report.considered} manifests: ${report.lines.length} read, ${report.excused.length} excused`,
+    report.sweeps > 1 ? `swept ${report.sweeps} times over ${report.waitedMs} ms` : ""
+  ].filter((one) => one !== "");
+  return `${[head, body, ...tail].filter((one) => one !== "").join("\n")}
+`;
+};
+
+// src/smoke.ts
+import { spawnSync } from "child_process";
+import {
+  cpSync,
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync4,
+  rmSync,
+  statSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { join as join3, relative as relative2, resolve as resolve2 } from "path";
+var SNAPSHOTS_DIR = ".geonosis/consumer-snapshots";
+var LOCKFILES = [
+  { file: "bun.lock", manager: "bun" },
+  { file: "bun.lockb", manager: "bun" },
+  { file: "pnpm-lock.yaml", manager: "pnpm" }
+];
+var UNMEASURED = [
+  { file: "package-lock.json", manager: "npm" },
+  { file: "yarn.lock", manager: "yarn" }
+];
+var EXCLUDED_DIRS = [
+  ".cache",
+  ".geonosis",
+  ".git",
+  ".next",
+  ".turbo",
+  ".wrangler",
+  "coverage",
+  "dist",
+  "node_modules",
+  "storybook-static"
+];
+var PHASES = ["typecheck", "lint", "doctor"];
+var headOf = (from) => {
+  const done = spawnSync("git", ["-C", from, "rev-parse", "HEAD"], { encoding: "utf8" });
+  if (done.error !== void 0) {
+    return { why: `git could not be run here: ${done.error.message}` };
+  }
+  if (done.status !== 0) {
+    return { why: `git says nothing about ${from}: ${done.stderr.trim()}` };
+  }
+  return { sha: done.stdout.trim() };
+};
+var DOCTOR_PACKAGE = "@geonosis/doctor";
+var DOCTOR_BIN = "geonosis-doctor";
+var DOCTOR_DOORS = ["@geonosis/cli", "geonosis"];
+var DOOR_BIN = "geonosis doctor";
+var isRecord2 = (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+var readManifest = (path) => {
+  try {
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    return isRecord2(parsed) ? parsed : {};
+  } catch (error) {
+    throw new CannotRun(`${path} is not readable JSON: ${error.message}`);
+  }
+};
+var versionsIn2 = (manifest) => {
+  const found = {};
+  for (const key of ["dependencies", "devDependencies"]) {
+    const block = manifest[key];
+    if (!isRecord2(block)) continue;
+    for (const [name, range] of Object.entries(block)) {
+      if (typeof range === "string") found[name] = range;
+    }
+  }
+  return Object.fromEntries(Object.entries(found).toSorted(([a], [b]) => a.localeCompare(b)));
+};
+var scriptsIn = (manifest) => {
+  const scripts = manifest["scripts"];
+  if (!isRecord2(scripts)) return {};
+  return Object.fromEntries(
+    Object.entries(scripts).filter((one) => typeof one[1] === "string")
+  );
+};
+var copyInto = (from, to, excluded) => {
+  let bytes = 0;
+  let files = 0;
+  const walk = (dir, into) => {
+    mkdirSync2(into, { recursive: true });
+    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+      if (excluded.has(entry.name)) continue;
+      const at = join3(dir, entry.name);
+      if (entry.isDirectory()) {
+        walk(at, join3(into, entry.name));
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      cpSync(at, join3(into, entry.name));
+      bytes += statSync(at).size;
+      files += 1;
+    }
+  };
+  walk(from, to);
+  return { bytes, files };
+};
+var manifestsUnder2 = (root) => {
+  const found = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync2(dir, { withFileTypes: true }).toSorted(
+      (a, b) => a.name.localeCompare(b.name)
+    )) {
+      const at = join3(dir, entry.name);
+      if (entry.isDirectory()) {
+        walk(at);
+        continue;
+      }
+      if (entry.name !== "package.json") continue;
+      found.push({ path: relative2(root, at), versions: versionsIn2(readManifest(at)) });
+    }
+  };
+  walk(root);
+  return found.toSorted((a, b) => a.path.localeCompare(b.path));
+};
+var managerOf = (from) => {
+  const found = LOCKFILES.find((one) => existsSync2(join3(from, one.file)));
+  if (found !== void 0) return { lockfile: found.file, manager: found.manager };
+  const unmeasured = UNMEASURED.find((one) => existsSync2(join3(from, one.file)));
+  if (unmeasured !== void 0) {
+    throw new CannotRun(
+      `${from} is a ${unmeasured.manager} tree (${unmeasured.file}), and the pack \u2192 rewrite \u2192 install path has never been measured under ${unmeasured.manager} here. It reads ${LOCKFILES.map((one) => one.file).join(", ")}.`
+    );
+  }
+  throw new CannotRun(
+    `nothing in ${from} says which runtime installs it \u2014 looked for ${[...LOCKFILES, ...UNMEASURED].map((one) => one.file).join(", ")}. The smoke installs the way the consumer installs, so the manager is read, never assumed.`
+  );
+};
+var commandsFor = (manifest, manifests, named) => {
+  const scripts = scriptsIn(manifest);
+  const installs = (name) => manifests.some((one) => one.versions[name] !== void 0);
+  const doctorCommand = installs(DOCTOR_PACKAGE) ? { exec: DOCTOR_BIN } : DOCTOR_DOORS.some(installs) ? { exec: DOOR_BIN } : {
+    why: `no manifest in this tree installs ${DOCTOR_PACKAGE} or a door that brings it (${DOCTOR_DOORS.join(", ")}), so nothing here can run ${DOCTOR_BIN}`
+  };
+  const phase = (name, fallback) => {
+    const override = named[name];
+    if (override !== void 0) return { exec: override };
+    if (scripts[name] !== void 0) return { run: name };
+    return fallback;
+  };
+  return {
+    doctor: phase("doctor", doctorCommand),
+    lint: phase("lint", { why: 'the tree has no "lint" script and no --lint command was named' }),
+    typecheck: phase("typecheck", {
+      why: 'the tree has no "typecheck" script and no --typecheck command was named'
+    })
+  };
+};
+var snapshotDir = (root, name) => join3(root, SNAPSHOTS_DIR, name);
+var readSnapshot = (root, name) => {
+  const at = join3(snapshotDir(root, name), "snapshot.json");
+  if (!existsSync2(at)) {
+    throw new CannotRun(
+      `there is no snapshot called "${name}" here \u2014 ${at} does not exist. Record one with: geonosis-release smoke snapshot ${name} --from <their tree>`
+    );
+  }
+  return JSON.parse(readFileSync4(at, "utf8"));
+};
+var wouldBeCommitted = (root, path) => {
+  const inside = spawnSync("git", ["rev-parse", "--is-inside-work-tree"], { cwd: root });
+  if (inside.error !== void 0 || inside.status !== 0) return false;
+  return spawnSync("git", ["check-ignore", "-q", path], { cwd: root }).status !== 0;
+};
+var NAME_SHAPE = /^[a-z0-9][\w.-]*$/i;
+var runSnapshot = (input) => {
+  if (!NAME_SHAPE.test(input.name)) {
+    throw new CannotRun(
+      `"${input.name}" is not a snapshot name \u2014 a name is letters, digits, dots, dashes and underscores, so that ${SNAPSHOTS_DIR}/<name> is the only place the bytes can land`
+    );
+  }
+  const from = resolve2(input.from);
+  if (!existsSync2(join3(from, "package.json"))) {
+    throw new CannotRun(`${from} has no package.json \u2014 that is not a tree a consumer installs`);
+  }
+  const at = snapshotDir(input.root, input.name);
+  if (wouldBeCommitted(input.root, join3(SNAPSHOTS_DIR, input.name))) {
+    throw new CannotRun(
+      `git here does not ignore ${SNAPSHOTS_DIR}/ \u2014 a consumer's tree is private (D-048) and a copy that reaches a commit cannot be taken back. Add ".geonosis/" to .gitignore and run this again.`
+    );
+  }
+  if (existsSync2(at) && !input.replace) {
+    throw new CannotRun(
+      `${at} is already a snapshot, and a baseline recorded against other bytes is worse than none \u2014 pass --replace to overwrite it`
+    );
+  }
+  const { lockfile, manager } = managerOf(from);
+  const excluded = [.../* @__PURE__ */ new Set([...EXCLUDED_DIRS, ...input.exclude ?? []])].toSorted();
+  rmSync(at, { force: true, recursive: true });
+  const tree = join3(at, "tree");
+  const { bytes, files } = copyInto(from, tree, new Set(excluded));
+  const manifests = manifestsUnder2(tree);
+  const record = {
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    bytes,
+    commit: headOf(from),
+    commands: commandsFor(readManifest(join3(tree, "package.json")), manifests, input.named),
+    excluded,
+    files,
+    from,
+    lockfile,
+    manager,
+    manifests,
+    name: input.name
+  };
+  writeFileSync2(join3(at, "snapshot.json"), `${JSON.stringify(record, void 0, 2)}
+`);
+  return record;
+};
+var describeCommand = (command) => {
+  if ("run" in command) return `run ${command.run}`;
+  if ("exec" in command) return command.exec;
+  return `nothing \u2014 ${command.why}`;
+};
+var describeCommit = (commit) => {
+  if (commit === void 0) return "nothing recorded its commit";
+  if ("sha" in commit) return commit.sha;
+  return commit.why;
+};
+var formatSnapshot = (record) => [
+  `OK    snapshot ${record.name}: ${record.files} files, ${record.bytes} bytes, ${record.manifests.length} manifests
+`,
+  `      from ${record.from} \u2014 ${record.manager} (${record.lockfile})
+`,
+  `      at ${describeCommit(record.commit)}
+`,
+  ...PHASES.map((phase) => `      ${phase}: ${describeCommand(record.commands[phase])}
+`)
+].join("");
+
+// src/adoption.ts
+import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
+import { join as join4 } from "path";
+var groupsOf = (root) => {
+  const at = join4(root, ".changeset/config.json");
+  if (!existsSync3(at)) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync5(at, "utf8"));
+  } catch (error) {
+    throw new CannotRun(`${at} is not readable JSON: ${error.message}`);
+  }
+  const fixed = parsed.fixed;
+  return Array.isArray(fixed) ? fixed.filter((one) => Array.isArray(one) && one.every(isString)) : [];
+};
+var isString = (value2) => typeof value2 === "string";
+var RANGE_PREFIX = /^[\^~>=<v\s]+/;
+var RELEASE_NUMBER = /^\d+\.\d+\.\d+(?:[-+][\w.-]+)?$/;
+var numberIn = (spec) => {
+  const bare = spec.replace(RANGE_PREFIX, "").trim();
+  return RELEASE_NUMBER.test(bare) ? bare : void 0;
+};
+var declarationsIn = (record, kit) => record.manifests.flatMap(
+  (manifest) => Object.entries(manifest.versions).filter(([name]) => kit.has(name)).map(([name, spec]) => ({ name, path: manifest.path, spec }))
+);
+var groupName = (index, total) => total > 1 ? `fixed group ${index + 1}` : "the fixed group";
+var incoherence = (consumer, groups, declarations) => groups.flatMap((group, index) => {
+  const members = new Set(group);
+  const versions = [
+    ...new Set(
+      declarations.filter((one) => members.has(one.name)).flatMap((one) => {
+        const number = numberIn(one.spec);
+        return number === void 0 ? [] : [number];
+      })
+    )
+  ].toSorted();
+  if (versions.length < 2) return [];
+  const name = groupName(index, groups.length);
+  return [
+    {
+      consumer,
+      detail: `${name} at ${versions.join(", ")} \u2014 they are published as one number, so this tree is a bump that landed halfway`,
+      name,
+      verdict: "INCOHERENT"
+    }
+  ];
+});
+var distance = (consumer, declarations, current) => declarations.flatMap((one) => {
+  const now = current.get(one.name);
+  if (now === void 0) return [];
+  const declared = numberIn(one.spec);
+  if (declared === void 0) {
+    return [
+      {
+        consumer,
+        detail: `${one.path} names it "${one.spec}", which is not a release number this can compare`,
+        name: one.name,
+        verdict: "UNJUDGED"
+      }
+    ];
+  }
+  if (declared === now) return [];
+  return [{ consumer, detail: `${declared} \u2192 ${now}`, name: one.name, verdict: "BEHIND" }];
+});
+var undeclaredFloors = (consumer, floors, declarations) => {
+  const declared = new Set(declarations.map((one) => one.name));
+  return floors.filter((name) => !declared.has(name)).map((name) => ({
+    consumer,
+    detail: "nothing in this tree declares it \u2014 informational, a floor is opted into",
+    name,
+    verdict: "FLOOR UNDECLARED"
+  }));
+};
+var currentVersions = async (root, registry) => {
+  const locals = censusOf(root).locals;
+  const current = new Map(locals.map((one) => [one.name, one.version]));
+  if (registry === void 0) return current;
+  for (const one of locals) {
+    const answer = await askRegistry({ name: one.name, registry });
+    if (answer.kind === "present" && answer.latest !== void 0)
+      current.set(one.name, answer.latest);
+  }
+  return current;
+};
+var runAdoption = async ({
+  declared,
+  registry,
+  root
+}) => {
+  if (declared.length === 0) {
+    throw new CannotRun(
+      "nothing here names a consumer to measure \u2014 geonosis.json \u2192 release.smoke.snapshots names them. An adoption sweep over zero consumers is not a scoreboard."
+    );
+  }
+  const current = await currentVersions(root, registry);
+  const groups = groupsOf(root);
+  const grouped = new Set(groups.flat());
+  const floors = [...current.keys()].filter((name) => !grouped.has(name)).toSorted();
+  const consumers = [];
+  const excused = [];
+  for (const one of declared) {
+    if (!existsSync3(join4(snapshotDir(root, one.name), "snapshot.json"))) {
+      excused.push({
+        path: one.name,
+        reason: `no recording of it here \u2014 record one with: geonosis-release smoke snapshot ${one.name} --from <their tree>`
+      });
+      continue;
+    }
+    const declarations = declarationsIn(readSnapshot(root, one.name), new Set(current.keys()));
+    consumers.push({
+      declared: declarations.length,
+      findings: [
+        ...distance(one.name, declarations, current),
+        ...incoherence(one.name, groups, declarations),
+        ...undeclaredFloors(one.name, floors, declarations)
+      ],
+      name: one.name
+    });
+  }
+  return {
+    considered: declared.length,
+    consumers,
+    excused,
+    registry,
+    versions: Object.fromEntries([...current.entries()].toSorted(([a], [b]) => a.localeCompare(b)))
+  };
+};
+var NOT_A_FAULT = /* @__PURE__ */ new Set(["FLOOR UNDECLARED"]);
+var lineOf = (finding) => {
+  if (finding.verdict === "INCOHERENT") return `  INCOHERENT ${finding.consumer}: ${finding.detail}`;
+  if (finding.verdict === "FLOOR UNDECLARED") {
+    return `  FLOOR UNDECLARED ${finding.consumer} ${finding.name}`;
+  }
+  return `  ${finding.verdict} ${finding.consumer} ${finding.name} ${finding.detail}`;
+};
+var blockFor = (consumer) => {
+  const faults = consumer.findings.filter((one) => !NOT_A_FAULT.has(one.verdict));
+  const head = faults.length === 0 ? [
+    `  MATCH ${consumer.name} \u2014 ${consumer.declared} spec(s) on the versions this release is cut at`
+  ] : [];
+  return [...head, ...new Set(consumer.findings.map(lineOf))];
+};
+var formatAdoption = (report) => [
+  `adoption \u2014 ${report.considered} declared, ${report.consumers.length} read, ${report.excused.length} excused; against ${report.registry ?? "this workspace"}`,
+  ...report.consumers.flatMap(blockFor),
+  ...report.excused.map((one) => `  SKIP ${one.path}: ${one.reason}`),
+  ""
+].join("\n");
+var ADOPTION_TOOL = "release-adoption";
+var ADOPTION_NEXT = "geonosis-release adoption --json and read `consumers` \u2014 every declared consumer leaves by exactly one door, read or excused, and a release review carries one row per consumer from it (D-061)";
+var adoptionEnvelope = (report, durationMs) => ({
+  considered: report.considered,
+  durationMs,
+  excused: report.excused,
+  findings: report.consumers.flatMap((one) => one.findings),
+  read: report.consumers.length,
+  refused: [],
+  tool: ADOPTION_TOOL,
+  version: versionOf(import.meta.url)
+});
+
+// src/wrangler.ts
+import { readFileSync as readFileSync6 } from "fs";
+import { resolve as resolve3 } from "path";
+var isRecord3 = (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+var parseJsonc = (source) => {
+  let out = "";
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index] ?? "";
+    if (char === '"') {
+      const start = index;
+      index += 1;
+      for (; index < source.length; index += 1) {
+        if (source[index] === "\\") {
+          index += 1;
+          continue;
+        }
+        if (source[index] === '"') break;
+      }
+      out += source.slice(start, index + 1);
+      continue;
+    }
+    if (char === "/" && source[index + 1] === "/") {
+      const end = source.indexOf("\n", index);
+      index = end === -1 ? source.length : end - 1;
+      continue;
+    }
+    if (char === "/" && source[index + 1] === "*") {
+      const end = source.indexOf("*/", index + 2);
+      index = end === -1 ? source.length : end + 1;
+      continue;
+    }
+    out += char;
+  }
+  return JSON.parse(out.replaceAll(/,(\s*[\]}])/g, "$1"));
+};
+var literal = (text) => {
+  const value2 = text.trim();
+  if (value2.startsWith('"') || value2.startsWith("'")) return value2.slice(1, -1);
+  if (value2 === "true") return true;
+  if (value2 === "false") return false;
+  const number = Number(value2);
+  return Number.isNaN(number) ? value2 : number;
+};
+var split = (text, delimiter) => {
+  const parts = [];
+  let depth = 0;
+  let quote = "";
+  let current = "";
+  for (const char of text) {
+    if (quote !== "") {
+      current += char;
+      if (char === quote) quote = "";
+      continue;
+    }
+    if (char === '"' || char === "'") quote = char;
+    if (char === "[" || char === "{") depth += 1;
+    if (char === "]" || char === "}") depth -= 1;
+    if (char === delimiter && depth === 0) {
+      parts.push(current);
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  parts.push(current);
+  return parts.filter((one) => one.trim() !== "");
+};
+var value = (text) => {
+  const trimmed = text.trim();
+  if (trimmed.startsWith("[")) return split(trimmed.slice(1, -1), ",").map(value);
+  if (trimmed.startsWith("{")) {
+    return Object.fromEntries(
+      split(trimmed.slice(1, -1), ",").map((pair) => {
+        const at = pair.indexOf("=");
+        return [pair.slice(0, at).trim(), value(pair.slice(at + 1))];
+      })
+    );
+  }
+  return literal(trimmed);
+};
+var put = (into, path, leaf) => {
+  let here = into;
+  for (const key of path.slice(0, -1)) {
+    if (!isRecord3(here[key])) here[key] = {};
+    here = here[key];
+  }
+  here[path.at(-1) ?? ""] = leaf;
+};
+var table = (into, path) => {
+  let here = into;
+  for (const key of path) {
+    if (!isRecord3(here[key])) here[key] = {};
+    here = here[key];
+  }
+  return here;
+};
+var arrayTable = (into, path) => {
+  let here = into;
+  for (const key of path.slice(0, -1)) {
+    if (!isRecord3(here[key])) here[key] = {};
+    here = here[key];
+  }
+  const last = path.at(-1) ?? "";
+  if (!Array.isArray(here[last])) here[last] = [];
+  const list = here[last];
+  const entry = {};
+  list.push(entry);
+  return entry;
+};
+var parseToml = (source) => {
+  const out = {};
+  let here = out;
+  const lines2 = source.split("\n");
+  for (let index = 0; index < lines2.length; index += 1) {
+    const line = (lines2[index] ?? "").split("#")[0]?.trim() ?? "";
+    if (line === "") continue;
+    if (line.startsWith("[[") && line.endsWith("]]")) {
+      here = arrayTable(out, line.slice(2, -2).trim().split("."));
+      continue;
+    }
+    if (line.startsWith("[") && line.endsWith("]")) {
+      here = table(out, line.slice(1, -1).trim().split("."));
+      continue;
+    }
+    const at = line.indexOf("=");
+    if (at === -1) continue;
+    let text = line.slice(at + 1);
+    while ([...text].filter((one) => one === "[").length > [...text].filter((one) => one === "]").length) {
+      index += 1;
+      if (index >= lines2.length) throw new CannotRun("an unterminated array in the TOML config");
+      text += `
+${(lines2[index] ?? "").split("#")[0] ?? ""}`;
+    }
+    put(here, line.slice(0, at).trim().split("."), value(text));
+  }
+  return out;
+};
+var BINDING_LISTS = [
+  "ai",
+  "analytics_engine_datasets",
+  "browser",
+  "d1_databases",
+  "dispatch_namespaces",
+  "durable_objects",
+  "hyperdrive",
+  "kv_namespaces",
+  "mtls_certificates",
+  "queues",
+  "r2_buckets",
+  "send_email",
+  "services",
+  "vectorize",
+  "version_metadata",
+  "workflows"
+];
+var bindingsOf = (found) => {
+  if (Array.isArray(found)) return found.flatMap(bindingsOf);
+  if (!isRecord3(found)) return [];
+  const named = found["binding"] ?? found["name"];
+  const here = typeof named === "string" ? [named] : [];
+  const nested = Object.entries(found).filter(([key]) => key === "bindings" || key === "producers" || key === "consumers").flatMap(([, one]) => bindingsOf(one));
+  return [...here, ...nested];
+};
+var declaredIn = (config) => {
+  const triggers = config["triggers"];
+  const crons = isRecord3(triggers) && Array.isArray(triggers["crons"]) ? triggers["crons"] : [];
+  const routes = config["routes"];
+  const one = config["route"];
+  const listed = [
+    ...Array.isArray(routes) ? routes : [],
+    ...typeof one === "string" ? [one] : []
+  ];
+  return {
+    bindings: BINDING_LISTS.flatMap((key) => bindingsOf(config[key])).toSorted(),
+    crons: crons.filter((cron) => typeof cron === "string").toSorted(),
+    routes: listed.map((route) => isRecord3(route) ? route["pattern"] : route).filter((pattern) => typeof pattern === "string").toSorted()
+  };
+};
+var readWrangler = (root, relative5, env) => {
+  const path = resolve3(root, relative5);
+  let parsed;
+  try {
+    const source = readFileSync6(path, "utf8");
+    parsed = relative5.endsWith(".toml") ? parseToml(source) : parseJsonc(source);
+  } catch (error) {
+    throw new CannotRun(`${relative5} could not be read: ${error.message}`);
+  }
+  if (!isRecord3(parsed)) throw new CannotRun(`${relative5} is not a wrangler configuration`);
+  const environments = parsed["env"];
+  const block = env !== void 0 && isRecord3(environments) && isRecord3(environments[env]) ? environments[env] : parsed;
+  return declaredIn(block);
+};
+
+// src/deployed.ts
+import { existsSync as existsSync4, readFileSync as readFileSync7 } from "fs";
+import { resolve as resolve4 } from "path";
+var DEPLOYED_FILE = ".geonosis/deployed.json";
+var NOTHING_SAYS = "nothing here says what is deployed \u2014 .geonosis/deployed.json is written by the pipeline after promote, and its absence is not a pass";
+var listOf = (found) => Array.isArray(found) ? found.filter((one) => typeof one === "string") : [];
+var isRecord4 = (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+var readDeployed = (root) => {
+  const path = resolve4(root, DEPLOYED_FILE);
+  if (!existsSync4(path)) throw new CannotRun(NOTHING_SAYS);
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync7(path, "utf8"));
+  } catch (error) {
+    throw new CannotRun(`${DEPLOYED_FILE} is not readable JSON: ${error.message}`);
+  }
+  if (!isRecord4(parsed)) throw new CannotRun(`${DEPLOYED_FILE} is not an object`);
+  const triggers = isRecord4(parsed["triggers"]) ? parsed["triggers"] : {};
+  return {
+    ...typeof parsed["at"] === "string" ? { at: parsed["at"] } : {},
+    deployed: {
+      bindings: listOf(parsed["bindings"]),
+      crons: listOf(triggers["crons"]),
+      routes: listOf(triggers["routes"]),
+      secrets: listOf(parsed["secrets"])
+    }
+  };
+};
+var missingBetween = (kind, declared, deployed) => {
+  const missing = declared.filter((one) => !deployed.includes(one));
+  const extra = deployed.filter((one) => !declared.includes(one));
+  return missing.length === 0 && extra.length === 0 ? [] : [{ extra, kind, missing }];
+};
+var driftBetween = (declared, deployed) => [
+  ...missingBetween("crons", declared.crons, deployed.crons),
+  ...missingBetween("routes", declared.routes, deployed.routes),
+  ...missingBetween("bindings", declared.bindings, deployed.bindings),
+  ...missingBetween("secrets", declared.secrets, deployed.secrets)
+];
 var runDeployed = (input) => {
   const config = readReleaseConfig(input.root);
   const configs = config.wrangler ?? [];
@@ -441,7 +1141,7 @@ var formatDeployed = (report) => {
 };
 
 // src/added.ts
-import { execFileSync, spawnSync } from "child_process";
+import { execFileSync, spawnSync as spawnSync2 } from "child_process";
 var git = (root, args) => {
   try {
     return execFileSync("git", [...args], { cwd: root, encoding: "utf8", stdio: "pipe" });
@@ -457,7 +1157,7 @@ var addedSince = (root, since) => {
   return [.../* @__PURE__ */ new Set([...committed, ...staged, ...untracked])].toSorted();
 };
 var gitOk = (root, args) => {
-  const run = spawnSync("git", [...args], { cwd: root, encoding: "utf8" });
+  const run = spawnSync2("git", [...args], { cwd: root, encoding: "utf8" });
   return run.error === void 0 && run.status === 0;
 };
 
@@ -647,32 +1347,32 @@ var NARROWING = [
   ["SET NOT NULL", /\bSET\s+NOT\s+NULL\b/i]
 ];
 var statementsOf = (sql) => sql.replaceAll(/'[^']*'/g, (found) => `'${found.slice(1, -1).replaceAll(/[^\n]/g, " ")}'`);
-var lineOf = (body, index) => body.slice(0, index).split("\n").length;
+var lineOf2 = (body, index) => body.slice(0, index).split("\n").length;
 var refusalsIn = (path, body, firstLine = 1) => {
   const stripped = statementsOf(body);
   return NARROWING.flatMap(([verb, pattern]) => {
     const found = pattern.exec(stripped);
-    return found === null ? [] : [{ line: lineOf(stripped, found.index) + firstLine - 1, path, verb }];
+    return found === null ? [] : [{ line: lineOf2(stripped, found.index) + firstLine - 1, path, verb }];
   });
 };
 
 // src/migrations.ts
-import { mkdtempSync, readFileSync as readFileSync4, rmSync, writeFileSync } from "fs";
+import { mkdtempSync, readFileSync as readFileSync8, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { tmpdir } from "os";
-import { basename, join, resolve as resolve5 } from "path";
+import { basename, join as join5, resolve as resolve6 } from "path";
 
 // src/squawk.ts
-import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync3 } from "fs";
-import { dirname, resolve as resolve4 } from "path";
-import { fileURLToPath } from "url";
-var HERE = dirname(fileURLToPath(import.meta.url));
+import { spawnSync as spawnSync3 } from "child_process";
+import { existsSync as existsSync5 } from "fs";
+import { dirname as dirname2, resolve as resolve5 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var HERE = dirname2(fileURLToPath2(import.meta.url));
 var PINNED = "2.63.0";
 var findSquawk = (from = HERE) => {
-  for (let dir = from; ; dir = dirname(dir)) {
-    const candidate = resolve4(dir, "node_modules/.bin/squawk");
-    if (existsSync3(candidate)) return candidate;
-    if (dirname(dir) === dir) break;
+  for (let dir = from; ; dir = dirname2(dir)) {
+    const candidate = resolve5(dir, "node_modules/.bin/squawk");
+    if (existsSync5(candidate)) return candidate;
+    if (dirname2(dir) === dir) break;
   }
   throw new CannotRun(
     `squawk-cli is not installed beside this package, and the postgres and mikro-orm-ts dialects cannot be measured without it \u2014 a gate that cannot measure has not passed. Install it:
@@ -685,7 +1385,7 @@ It is an optional peer: a repo whose release.migrations names only the sqlite di
 var squawkOn = (input) => {
   const { cwd, exclude, files } = input;
   if (files.length === 0) return { findings: "", ok: true };
-  const run = spawnSync2(
+  const run = spawnSync3(
     input.bin ?? findSquawk(),
     [...exclude.length === 0 ? [] : [`--exclude=${exclude.join(",")}`], ...files],
     { cwd, encoding: "utf8" }
@@ -752,7 +1452,7 @@ var runMigrations = (input) => {
   const forSquawk = [];
   const states = /* @__PURE__ */ new Map();
   for (const { entry, file } of matched) {
-    const source = readFileSync4(resolve5(input.root, file), "utf8");
+    const source = readFileSync8(resolve6(input.root, file), "utf8");
     const found = markersIn(source);
     const bad = found.flatMap((one) => {
       const why = judge(one, input.root, input.since);
@@ -777,11 +1477,11 @@ var runMigrations = (input) => {
   }
   let clean = true;
   if (forSquawk.length > 0) {
-    const staging = mkdtempSync(join(tmpdir(), "geonosis-release-squawk-"));
+    const staging = mkdtempSync(join5(tmpdir(), "geonosis-release-squawk-"));
     try {
       for (const one of forSquawk) {
-        const path = one.entry.dialect === "mikro-orm-ts" ? join(staging, `${basename(one.file, ".ts")}.sql`) : resolve5(input.root, one.file);
-        if (one.entry.dialect === "mikro-orm-ts") writeFileSync(path, `${one.sql}
+        const path = one.entry.dialect === "mikro-orm-ts" ? join5(staging, `${basename(one.file, ".ts")}.sql`) : resolve6(input.root, one.file);
+        if (one.entry.dialect === "mikro-orm-ts") writeFileSync3(path, `${one.sql}
 `);
         const found = squawkOn({
           cwd: input.root,
@@ -795,7 +1495,7 @@ var runMigrations = (input) => {
         }
       }
     } finally {
-      rmSync(staging, { force: true, recursive: true });
+      rmSync2(staging, { force: true, recursive: true });
     }
   }
   return {
@@ -959,8 +1659,8 @@ var Runner = class {
 };
 
 // src/prove.ts
-import { existsSync as existsSync4 } from "fs";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { existsSync as existsSync6 } from "fs";
+import { fileURLToPath as fileURLToPath3 } from "url";
 var stringAt = (reply, key) => typeof reply[key] === "string" ? reply[key] : void 0;
 var proveOver = async (input) => {
   const runner = new Runner(input.command, input.args ?? [], input.cwd);
@@ -988,242 +1688,68 @@ var proveOver = async (input) => {
     steps.push("promote");
     const promoted = await runner.ask({ step: "promote", versionId }, input.timeoutMs);
     if (promoted["ok"] !== true) return refuse(`the promote of ${versionId} did not pass`);
-    const went = stringAt(promoted, "promotedVersionId");
-    if (went !== void 0 && went !== versionId) {
-      return refuse(`${versionId} was proved and ${went} was promoted \u2014 nothing proved ${went}`);
-    }
-    return { ok: true, steps };
-  } finally {
-    runner.close();
-  }
-};
-var PLANTS = [
-  {
-    name: "answered",
-    says: "a smoke that answered a version other than the one it overrode to is refused"
-  },
-  { name: "failed", says: "a smoke that did not pass is refused" },
-  { name: "promoted", says: "a promote of a version nothing proved is refused" }
-];
-var stubPath = () => {
-  const path = fileURLToPath2(new URL("./stub-runner.js", import.meta.url));
-  if (!existsSync4(path)) throw new CannotRun(`${path} is missing \u2014 run pnpm build first`);
-  return path;
-};
-var prove = async (cwd, stub = stubPath()) => {
-  const lines2 = [];
-  let ok = true;
-  for (const plant of PLANTS) {
-    const verdict = await proveOver({
-      args: [stub, `--plant=${plant.name}`],
-      command: process.execPath,
-      cwd,
-      timeoutMs: 3e4
-    });
-    if (verdict.ok) ok = false;
-    lines2.push(`  ${verdict.ok ? "MISSED" : "PROVEN"} ${plant.says}`);
-    if (plant.name !== "promoted" && verdict.steps.includes("promote")) {
-      ok = false;
-      lines2.push("  MISSED a refused smoke was followed by a promote request");
-    }
-  }
-  const honest = await proveOver({
-    args: [stub, "--plant=good"],
-    command: process.execPath,
-    cwd,
-    timeoutMs: 3e4
-  });
-  if (!honest.ok) ok = false;
-  lines2.push(
-    `  ${honest.ok ? "PROVEN" : "MISSED"} a smoke that answered the version it overrode to is not refused`
-  );
-  return { lines: lines2, ok };
-};
-var formatProve = (outcome) => `${outcome.lines.join("\n")}
-
-prove ${outcome.ok ? "PASS" : "FAIL"} \u2014 ${outcome.ok ? "every plant was refused, and the honest runner was not" : "a plant went through"}.
-`;
-var formatVerdict = (verdict) => verdict.ok ? `OK    prove: ${verdict.steps.join(" \u2192 ")}
-` : `  REFUSED after ${verdict.steps.join(" \u2192 ")}: ${verdict.why ?? ""}
-`;
-
-// src/registry.ts
-var DEFAULT_REGISTRY = "https://registry.npmjs.org";
-var TIMEOUT_MS = 15e3;
-var registryPathOf = (name) => name.startsWith("@") ? `@${encodeURIComponent(name.slice(1))}` : encodeURIComponent(name);
-var versionsIn = (body) => {
-  const versions = body.versions;
-  return typeof versions === "object" && versions !== null ? Object.keys(versions) : [];
-};
-var latestIn = (body) => {
-  const tags = body["dist-tags"];
-  const latest = typeof tags === "object" && tags !== null ? tags.latest : void 0;
-  return typeof latest === "string" ? latest : void 0;
-};
-var askRegistry = async ({
-  name,
-  registry = DEFAULT_REGISTRY,
-  timeoutMs = TIMEOUT_MS
-}) => {
-  const url = `${registry.replace(/\/+$/, "")}/${registryPathOf(name)}`;
-  let response;
-  try {
-    response = await fetch(url, {
-      headers: { accept: "application/json" },
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-  } catch (error) {
-    return { kind: "unreachable", name, why: `GET ${url} \u2014 ${error.message}` };
-  }
-  if (response.status === 404) return { kind: "absent", name };
-  if (!response.ok) {
-    return { kind: "unreachable", name, why: `GET ${url} \u2014 HTTP ${response.status}` };
-  }
-  let body;
-  try {
-    body = await response.json();
-  } catch (error) {
-    return {
-      kind: "unreachable",
-      name,
-      why: `GET ${url} answered ${response.status} with something that is not JSON \u2014 ${error.message}`
-    };
-  }
-  return { kind: "present", latest: latestIn(body), name, versions: versionsIn(body) };
-};
-
-// src/published.ts
-import { readdirSync, readFileSync as readFileSync5 } from "fs";
-import { join as join2, relative, sep } from "path";
-var NEVER_WALKED = /* @__PURE__ */ new Set(["build", "coverage", "dist", "node_modules", "storybook-static"]);
-var pathOf = (root, path) => relative(root, path).split(sep).join("/");
-var manifestsUnder = (root) => {
-  const found = [];
-  const walk = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (entry.isDirectory()) {
-        if (!entry.name.startsWith(".") && !NEVER_WALKED.has(entry.name))
-          walk(join2(dir, entry.name));
-        continue;
-      }
-      if (entry.name === "package.json") found.push(join2(dir, entry.name));
-    }
-  };
-  walk(root);
-  return found;
-};
-var censusOf = (root) => {
-  const excused = [];
-  const locals = [];
-  for (const path of manifestsUnder(root)) {
-    const at = pathOf(root, path);
-    let manifest;
-    try {
-      manifest = JSON.parse(readFileSync5(path, "utf8"));
-    } catch (error) {
-      excused.push({ path: at, reason: `it does not parse: ${error.message}` });
-      continue;
-    }
-    if (manifest.private === true) {
-      excused.push({ path: at, reason: "private: true \u2014 nothing publishes it" });
-      continue;
-    }
-    if (typeof manifest.name !== "string" || manifest.name === "") {
-      excused.push({ path: at, reason: "it names no package" });
-      continue;
-    }
-    if (typeof manifest.version !== "string" || manifest.version === "") {
-      excused.push({ path: at, reason: "it declares no version" });
-      continue;
-    }
-    locals.push({ at, name: manifest.name, version: manifest.version });
-  }
-  return { excused, locals: locals.toSorted((a, b) => a.name.localeCompare(b.name)) };
-};
-var EXISTS_BUT = "exists but no version matching";
-var lineFor = async (local, registry) => {
-  const answer = await askRegistry({ name: local.name, registry });
-  const base = { at: local.at, local: local.version, name: local.name };
-  if (answer.kind === "unreachable") {
-    return { ...base, latest: void 0, verdict: "UNREACHABLE", why: answer.why };
-  }
-  if (answer.kind === "absent") {
-    return {
-      ...base,
-      latest: void 0,
-      verdict: "ABSENT",
-      why: "npm has never heard of this name \u2014 a name published moments ago 404s for a few minutes; --wait <seconds> polls through that window"
-    };
-  }
-  if (answer.latest === local.version) {
-    return { ...base, latest: answer.latest, verdict: "MATCH", why: "on npm" };
-  }
-  return {
-    ...base,
-    latest: answer.latest,
-    verdict: "BEHIND",
-    why: answer.versions.includes(local.version) ? `npm has ${local.version}, and its latest tag is ${answer.latest ?? "nothing"} \u2014 the group has not landed on one version` : `the package ${EXISTS_BUT} ${local.version}; npm answers ${answer.latest ?? "nothing"}. Minutes after a publish, suspect the package manager's manifest cache before the registry`
-  };
-};
-var sleep = (ms) => new Promise((done) => {
-  setTimeout(done, ms);
-});
-var POLL_MS = 5e3;
-var runPublished = async ({
-  pollMs = POLL_MS,
-  registry = DEFAULT_REGISTRY,
-  root,
-  waitSeconds = 0
-}) => {
-  const { excused, locals } = censusOf(root);
-  const startedAt = Date.now();
-  const budgetMs = Math.max(0, waitSeconds * 1e3);
-  let lines2 = [];
-  let sweeps = 0;
-  for (; ; ) {
-    lines2 = [];
-    for (const local of locals) lines2.push(await lineFor(local, registry));
-    sweeps += 1;
-    const settled = lines2.every((one) => one.verdict === "MATCH");
-    const stuck = lines2.some((one) => one.verdict === "UNREACHABLE");
-    const left = budgetMs - (Date.now() - startedAt);
-    if (settled || stuck || left <= 0) break;
-    await sleep(Math.min(pollMs, left));
+    const went = stringAt(promoted, "promotedVersionId");
+    if (went !== void 0 && went !== versionId) {
+      return refuse(`${versionId} was proved and ${went} was promoted \u2014 nothing proved ${went}`);
+    }
+    return { ok: true, steps };
+  } finally {
+    runner.close();
   }
-  const unreachable = lines2.filter((one) => one.verdict === "UNREACHABLE").length;
-  return {
-    considered: lines2.length + excused.length,
-    excused: excused.toSorted((a, b) => a.path.localeCompare(b.path)),
-    lines: lines2,
-    ok: lines2.length > 0 && lines2.every((one) => one.verdict === "MATCH"),
-    registry,
-    sweeps,
-    unreachable,
-    waitedMs: Date.now() - startedAt
-  };
 };
-var NOTHING_TO_CHECK = "published FAIL \u2014 no workspace in this tree declares a package a publish could be about, and a check that considered nothing has not passed";
-var formatPublished = (report) => {
-  const width = Math.max(1, ...report.lines.map((one) => one.name.length));
-  const body = report.lines.map((one) => `  ${one.verdict.padEnd(11)} ${one.name.padEnd(width)} ${one.local}  ${one.why}`).join("\n");
-  const head = report.lines.length === 0 ? NOTHING_TO_CHECK : `published ${report.ok ? "PASS" : "FAIL"} \u2014 ${report.lines.filter((one) => one.verdict === "MATCH").length}/${report.lines.length} of the group on ${report.registry}`;
-  const tail = [
-    `considered ${report.considered} manifests: ${report.lines.length} read, ${report.excused.length} excused`,
-    report.sweeps > 1 ? `swept ${report.sweeps} times over ${report.waitedMs} ms` : ""
-  ].filter((one) => one !== "");
-  return `${[head, body, ...tail].filter((one) => one !== "").join("\n")}
-`;
+var PLANTS = [
+  {
+    name: "answered",
+    says: "a smoke that answered a version other than the one it overrode to is refused"
+  },
+  { name: "failed", says: "a smoke that did not pass is refused" },
+  { name: "promoted", says: "a promote of a version nothing proved is refused" }
+];
+var stubPath = () => {
+  const path = fileURLToPath3(new URL("./stub-runner.js", import.meta.url));
+  if (!existsSync6(path)) throw new CannotRun(`${path} is missing \u2014 run pnpm build first`);
+  return path;
+};
+var prove = async (cwd, stub = stubPath()) => {
+  const lines2 = [];
+  let ok = true;
+  for (const plant of PLANTS) {
+    const verdict = await proveOver({
+      args: [stub, `--plant=${plant.name}`],
+      command: process.execPath,
+      cwd,
+      timeoutMs: 3e4
+    });
+    if (verdict.ok) ok = false;
+    lines2.push(`  ${verdict.ok ? "MISSED" : "PROVEN"} ${plant.says}`);
+    if (plant.name !== "promoted" && verdict.steps.includes("promote")) {
+      ok = false;
+      lines2.push("  MISSED a refused smoke was followed by a promote request");
+    }
+  }
+  const honest = await proveOver({
+    args: [stub, "--plant=good"],
+    command: process.execPath,
+    cwd,
+    timeoutMs: 3e4
+  });
+  if (!honest.ok) ok = false;
+  lines2.push(
+    `  ${honest.ok ? "PROVEN" : "MISSED"} a smoke that answered the version it overrode to is not refused`
+  );
+  return { lines: lines2, ok };
 };
+var formatProve = (outcome) => `${outcome.lines.join("\n")}
+
+prove ${outcome.ok ? "PASS" : "FAIL"} \u2014 ${outcome.ok ? "every plant was refused, and the honest runner was not" : "a plant went through"}.
+`;
+var formatVerdict = (verdict) => verdict.ok ? `OK    prove: ${verdict.steps.join(" \u2192 ")}
+` : `  REFUSED after ${verdict.steps.join(" \u2192 ")}: ${verdict.why ?? ""}
+`;
 
 // src/schema-walls.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
-import { join as join3, relative as relative2, resolve as resolve6, sep as sep2 } from "path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync9 } from "fs";
+import { join as join6, relative as relative3, resolve as resolve7, sep as sep2 } from "path";
 var MIGRATION_FILE = /\.(?:sql|ts)$/;
 var CURRENT_SETTING = /current_setting\s*\(\s*'([^']+)'/gi;
 var filesUnder = (root, dir) => {
@@ -1231,20 +1757,20 @@ var filesUnder = (root, dir) => {
   const walk = (at) => {
     let entries;
     try {
-      entries = readdirSync2(at, { withFileTypes: true });
+      entries = readdirSync3(at, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
-      const path = join3(at, entry.name);
+      const path = join6(at, entry.name);
       if (entry.isDirectory()) walk(path);
       else if (MIGRATION_FILE.test(entry.name)) found.push(path);
     }
   };
-  walk(resolve6(root, dir));
-  return found.map((path) => relative2(root, path).split(sep2).join("/")).toSorted();
+  walk(resolve7(root, dir));
+  return found.map((path) => relative3(root, path).split(sep2).join("/")).toSorted();
 };
-var lineOf2 = (body, index) => body.slice(0, index).split("\n").length;
+var lineOf3 = (body, index) => body.slice(0, index).split("\n").length;
 var wordFor = (table2) => new RegExp(
   String.raw`(?<![\w.])${table2.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`)}\b`,
   "i"
@@ -1258,7 +1784,7 @@ var foreignTables = (path, sql, schema) => {
       const found = wordFor(table2).exec(sql);
       return found === null ? [] : [
         {
-          line: lineOf2(sql, found.index),
+          line: lineOf3(sql, found.index),
           path,
           why: `"${mine.name}" names "${table2}", which "${other.name}" declares. A domain's migrations may only touch its own tables \u2014 cross-domain talk goes through events, and a foreign key here is a coupling no import graph shows`
         }
@@ -1274,404 +1800,98 @@ var undeclaredSettings = (path, source, schema) => {
     const name = match[1] ?? "";
     if (allowed.has(name)) continue;
     found.push({
-      line: lineOf2(source, match.index),
+      line: lineOf3(source, match.index),
       path,
       why: `current_setting('${name}') names a session variable this repo has not declared. release.schema.sessionVariables holds ${schema.sessionVariables.join(", ")} \u2014 add it there, or take the name as an option so the DDL is not written for one consumer's session`
-    });
-  }
-  return found;
-};
-var runSchema = ({ root }) => {
-  const schema = readReleaseConfig(root).schema;
-  if (schema === void 0) {
-    throw new CannotRun(
-      "geonosis.json names no release.schema \u2014 nothing here says which tables belong to which domain, or which session variables the DDL may name (#168)"
-    );
-  }
-  if (schema.domains.length === 0 && schema.sessionVariables.length === 0) {
-    throw new CannotRun(
-      "release.schema is declared and holds neither domains nor sessionVariables \u2014 say which tables belong to which domain and which session variables the DDL may name, or remove the block: a check with nothing to compare against reads exactly like a clean schema"
-    );
-  }
-  const dirs = schema.domains.map((one) => one.dir);
-  const files = [...new Set(dirs.flatMap((dir) => filesUnder(root, dir)))].toSorted();
-  const findings = [];
-  const unreadable = [];
-  for (const path of files) {
-    const source = readFileSync6(resolve6(root, path), "utf8");
-    let sql;
-    try {
-      sql = sqlOf(path, source);
-    } catch (error) {
-      if (!(error instanceof Unreadable)) throw error;
-      unreadable.push({ path, why: `${path} holds ${error.message} \u2014 this reader cannot read it` });
-      continue;
-    }
-    findings.push(...foreignTables(path, sql, schema), ...undeclaredSettings(path, source, schema));
-  }
-  return {
-    dirs,
-    files,
-    findings: findings.toSorted((a, b) => a.path.localeCompare(b.path) || a.line - b.line),
-    ok: findings.length === 0 && unreadable.length === 0,
-    read: files.length - unreadable.length,
-    unreadable
-  };
-};
-var formatSchema = (report) => {
-  if (report.files.length === 0) {
-    return `NONE  schema: no migration file under ${report.dirs.join(", ")}; nothing was read
-`;
-  }
-  if (report.ok) {
-    return `OK    schema: ${report.read} migration(s) read under ${report.dirs.length} declared domain(s), no wall crossed
-`;
-  }
-  const said = report.findings.map((one) => `  ${one.path}:${one.line}: ${one.why}
-`);
-  const cannot = report.unreadable.map((one) => `  ${one.why}
-`);
-  return `${said.join("")}${cannot.join("")}schema: ${report.read} of ${report.files.length} files read \u2014 ${report.findings.length} finding(s)${report.unreadable.length === 0 ? "" : `, ${report.unreadable.length} unreadable`}
-`;
-};
-
-// src/smoke.ts
-import { spawnSync as spawnSync3 } from "child_process";
-import {
-  cpSync,
-  existsSync as existsSync5,
-  mkdirSync,
-  readdirSync as readdirSync3,
-  readFileSync as readFileSync7,
-  rmSync as rmSync2,
-  statSync,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { join as join4, relative as relative3, resolve as resolve7 } from "path";
-var SNAPSHOTS_DIR = ".geonosis/consumer-snapshots";
-var LOCKFILES = [
-  { file: "bun.lock", manager: "bun" },
-  { file: "bun.lockb", manager: "bun" },
-  { file: "pnpm-lock.yaml", manager: "pnpm" }
-];
-var UNMEASURED = [
-  { file: "package-lock.json", manager: "npm" },
-  { file: "yarn.lock", manager: "yarn" }
-];
-var EXCLUDED_DIRS = [
-  ".cache",
-  ".geonosis",
-  ".git",
-  ".next",
-  ".turbo",
-  ".wrangler",
-  "coverage",
-  "dist",
-  "node_modules",
-  "storybook-static"
-];
-var PHASES = ["typecheck", "lint", "doctor"];
-var DOCTOR_PACKAGE = "@geonosis/doctor";
-var DOCTOR_BIN = "geonosis-doctor";
-var DOCTOR_DOORS = ["@geonosis/cli", "geonosis"];
-var DOOR_BIN = "geonosis doctor";
-var isRecord4 = (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
-var readManifest = (path) => {
-  try {
-    const parsed = JSON.parse(readFileSync7(path, "utf8"));
-    return isRecord4(parsed) ? parsed : {};
-  } catch (error) {
-    throw new CannotRun(`${path} is not readable JSON: ${error.message}`);
-  }
-};
-var versionsIn2 = (manifest) => {
-  const found = {};
-  for (const key of ["dependencies", "devDependencies"]) {
-    const block = manifest[key];
-    if (!isRecord4(block)) continue;
-    for (const [name, range] of Object.entries(block)) {
-      if (typeof range === "string") found[name] = range;
-    }
-  }
-  return Object.fromEntries(Object.entries(found).toSorted(([a], [b]) => a.localeCompare(b)));
-};
-var scriptsIn = (manifest) => {
-  const scripts = manifest["scripts"];
-  if (!isRecord4(scripts)) return {};
-  return Object.fromEntries(
-    Object.entries(scripts).filter((one) => typeof one[1] === "string")
-  );
-};
-var copyInto = (from, to, excluded) => {
-  let bytes = 0;
-  let files = 0;
-  const walk = (dir, into) => {
-    mkdirSync(into, { recursive: true });
-    for (const entry of readdirSync3(dir, { withFileTypes: true })) {
-      if (excluded.has(entry.name)) continue;
-      const at = join4(dir, entry.name);
-      if (entry.isDirectory()) {
-        walk(at, join4(into, entry.name));
-        continue;
-      }
-      if (!entry.isFile()) continue;
-      cpSync(at, join4(into, entry.name));
-      bytes += statSync(at).size;
-      files += 1;
-    }
-  };
-  walk(from, to);
-  return { bytes, files };
-};
-var manifestsUnder2 = (root) => {
-  const found = [];
-  const walk = (dir) => {
-    for (const entry of readdirSync3(dir, { withFileTypes: true }).toSorted(
-      (a, b) => a.name.localeCompare(b.name)
-    )) {
-      const at = join4(dir, entry.name);
-      if (entry.isDirectory()) {
-        walk(at);
-        continue;
-      }
-      if (entry.name !== "package.json") continue;
-      found.push({ path: relative3(root, at), versions: versionsIn2(readManifest(at)) });
-    }
-  };
-  walk(root);
-  return found.toSorted((a, b) => a.path.localeCompare(b.path));
-};
-var managerOf = (from) => {
-  const found = LOCKFILES.find((one) => existsSync5(join4(from, one.file)));
-  if (found !== void 0) return { lockfile: found.file, manager: found.manager };
-  const unmeasured = UNMEASURED.find((one) => existsSync5(join4(from, one.file)));
-  if (unmeasured !== void 0) {
-    throw new CannotRun(
-      `${from} is a ${unmeasured.manager} tree (${unmeasured.file}), and the pack \u2192 rewrite \u2192 install path has never been measured under ${unmeasured.manager} here. It reads ${LOCKFILES.map((one) => one.file).join(", ")}.`
-    );
-  }
-  throw new CannotRun(
-    `nothing in ${from} says which runtime installs it \u2014 looked for ${[...LOCKFILES, ...UNMEASURED].map((one) => one.file).join(", ")}. The smoke installs the way the consumer installs, so the manager is read, never assumed.`
-  );
-};
-var commandsFor = (manifest, manifests, named) => {
-  const scripts = scriptsIn(manifest);
-  const installs = (name) => manifests.some((one) => one.versions[name] !== void 0);
-  const doctorCommand = installs(DOCTOR_PACKAGE) ? { exec: DOCTOR_BIN } : DOCTOR_DOORS.some(installs) ? { exec: DOOR_BIN } : {
-    why: `no manifest in this tree installs ${DOCTOR_PACKAGE} or a door that brings it (${DOCTOR_DOORS.join(", ")}), so nothing here can run ${DOCTOR_BIN}`
-  };
-  const phase = (name, fallback) => {
-    const override = named[name];
-    if (override !== void 0) return { exec: override };
-    if (scripts[name] !== void 0) return { run: name };
-    return fallback;
-  };
-  return {
-    doctor: phase("doctor", doctorCommand),
-    lint: phase("lint", { why: 'the tree has no "lint" script and no --lint command was named' }),
-    typecheck: phase("typecheck", {
-      why: 'the tree has no "typecheck" script and no --typecheck command was named'
-    })
-  };
-};
-var snapshotDir = (root, name) => join4(root, SNAPSHOTS_DIR, name);
-var readSnapshot = (root, name) => {
-  const at = join4(snapshotDir(root, name), "snapshot.json");
-  if (!existsSync5(at)) {
-    throw new CannotRun(
-      `there is no snapshot called "${name}" here \u2014 ${at} does not exist. Record one with: geonosis-release smoke snapshot ${name} --from <their tree>`
-    );
+    });
   }
-  return JSON.parse(readFileSync7(at, "utf8"));
-};
-var wouldBeCommitted = (root, path) => {
-  const inside = spawnSync3("git", ["rev-parse", "--is-inside-work-tree"], { cwd: root });
-  if (inside.error !== void 0 || inside.status !== 0) return false;
-  return spawnSync3("git", ["check-ignore", "-q", path], { cwd: root }).status !== 0;
+  return found;
 };
-var NAME_SHAPE = /^[a-z0-9][\w.-]*$/i;
-var runSnapshot = (input) => {
-  if (!NAME_SHAPE.test(input.name)) {
+var runSchema = ({ root }) => {
+  const schema = readReleaseConfig(root).schema;
+  if (schema === void 0) {
     throw new CannotRun(
-      `"${input.name}" is not a snapshot name \u2014 a name is letters, digits, dots, dashes and underscores, so that ${SNAPSHOTS_DIR}/<name> is the only place the bytes can land`
+      "geonosis.json names no release.schema \u2014 nothing here says which tables belong to which domain, or which session variables the DDL may name (#168)"
     );
   }
-  const from = resolve7(input.from);
-  if (!existsSync5(join4(from, "package.json"))) {
-    throw new CannotRun(`${from} has no package.json \u2014 that is not a tree a consumer installs`);
-  }
-  const at = snapshotDir(input.root, input.name);
-  if (wouldBeCommitted(input.root, join4(SNAPSHOTS_DIR, input.name))) {
+  if (schema.domains.length === 0 && schema.sessionVariables.length === 0) {
     throw new CannotRun(
-      `git here does not ignore ${SNAPSHOTS_DIR}/ \u2014 a consumer's tree is private (D-048) and a copy that reaches a commit cannot be taken back. Add ".geonosis/" to .gitignore and run this again.`
+      "release.schema is declared and holds neither domains nor sessionVariables \u2014 say which tables belong to which domain and which session variables the DDL may name, or remove the block: a check with nothing to compare against reads exactly like a clean schema"
     );
   }
-  if (existsSync5(at) && !input.replace) {
-    throw new CannotRun(
-      `${at} is already a snapshot, and a baseline recorded against other bytes is worse than none \u2014 pass --replace to overwrite it`
-    );
+  const dirs = schema.domains.map((one) => one.dir);
+  const files = [...new Set(dirs.flatMap((dir) => filesUnder(root, dir)))].toSorted();
+  const findings = [];
+  const unreadable = [];
+  for (const path of files) {
+    const source = readFileSync9(resolve7(root, path), "utf8");
+    let sql;
+    try {
+      sql = sqlOf(path, source);
+    } catch (error) {
+      if (!(error instanceof Unreadable)) throw error;
+      unreadable.push({ path, why: `${path} holds ${error.message} \u2014 this reader cannot read it` });
+      continue;
+    }
+    findings.push(...foreignTables(path, sql, schema), ...undeclaredSettings(path, source, schema));
   }
-  const { lockfile, manager } = managerOf(from);
-  const excluded = [.../* @__PURE__ */ new Set([...EXCLUDED_DIRS, ...input.exclude ?? []])].toSorted();
-  rmSync2(at, { force: true, recursive: true });
-  const tree = join4(at, "tree");
-  const { bytes, files } = copyInto(from, tree, new Set(excluded));
-  const manifests = manifestsUnder2(tree);
-  const record = {
-    at: (/* @__PURE__ */ new Date()).toISOString(),
-    bytes,
-    commands: commandsFor(readManifest(join4(tree, "package.json")), manifests, input.named),
-    excluded,
+  return {
+    dirs,
     files,
-    from,
-    lockfile,
-    manager,
-    manifests,
-    name: input.name
+    findings: findings.toSorted((a, b) => a.path.localeCompare(b.path) || a.line - b.line),
+    ok: findings.length === 0 && unreadable.length === 0,
+    read: files.length - unreadable.length,
+    unreadable
   };
-  writeFileSync2(join4(at, "snapshot.json"), `${JSON.stringify(record, void 0, 2)}
-`);
-  return record;
-};
-var describeCommand = (command) => {
-  if ("run" in command) return `run ${command.run}`;
-  if ("exec" in command) return command.exec;
-  return `nothing \u2014 ${command.why}`;
-};
-var formatSnapshot = (record) => [
-  `OK    snapshot ${record.name}: ${record.files} files, ${record.bytes} bytes, ${record.manifests.length} manifests
-`,
-  `      from ${record.from} \u2014 ${record.manager} (${record.lockfile})
-`,
-  ...PHASES.map((phase) => `      ${phase}: ${describeCommand(record.commands[phase])}
-`)
-].join("");
-
-// src/envelope.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname2, join as join5 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
-var ENVELOPES_DIR = ".geonosis/envelopes";
-var envelopePath = (root, tool) => join5(root, ENVELOPES_DIR, `${tool}.json`);
-var UnbalancedEnvelope = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "UnbalancedEnvelope";
-  }
 };
-var isCount = (value2) => Number.isSafeInteger(value2) && value2 >= 0;
-var unbalancedMessage = (envelope, next) => `${envelope.tool}: considered ${envelope.considered} but accounts for ${envelope.read + envelope.refused.length + envelope.excused.length} \u2014 ${envelope.read} read + ${envelope.refused.length} refused + ${envelope.excused.length} excused. A run that has lost count of its own inputs cannot say what it measured, so no verdict was rendered and no envelope was written. Next: ${next}`;
-var writeEnvelope = ({
-  envelope,
-  next,
-  root
-}) => {
-  if (envelope.tool.trim() === "") {
-    throw new UnbalancedEnvelope(
-      `an envelope with no tool name cannot be filed or reported against. Next: ${next}`
-    );
-  }
-  if (envelope.version.trim() === "") {
-    throw new UnbalancedEnvelope(
-      `${envelope.tool}: an envelope that cannot name the build that wrote it dates nothing, and a stale one reads exactly like a fresh one. Next: ${next}`
-    );
-  }
-  if (!isCount(envelope.considered) || !isCount(envelope.read)) {
-    throw new UnbalancedEnvelope(
-      `${envelope.tool}: considered ${envelope.considered} and read ${envelope.read} \u2014 a census is a whole number of things, and arithmetic over anything else balances by accident. Next: ${next}`
-    );
+var formatSchema = (report) => {
+  if (report.files.length === 0) {
+    return `NONE  schema: no migration file under ${report.dirs.join(", ")}; nothing was read
+`;
   }
-  if (envelope.considered !== envelope.read + envelope.refused.length + envelope.excused.length) {
-    throw new UnbalancedEnvelope(unbalancedMessage(envelope, next));
+  if (report.ok) {
+    return `OK    schema: ${report.read} migration(s) read under ${report.dirs.length} declared domain(s), no wall crossed
+`;
   }
-  const at = envelopePath(root, envelope.tool);
-  mkdirSync2(dirname2(at), { recursive: true });
-  writeFileSync3(at, `${JSON.stringify(envelope, void 0, 2)}
+  const said = report.findings.map((one) => `  ${one.path}:${one.line}: ${one.why}
 `);
-  return at;
-};
-var UNKNOWN = "unknown";
-var versionIn = (dir) => {
-  try {
-    const manifest = JSON.parse(readFileSync8(join5(dir, "package.json"), "utf8"));
-    return typeof manifest.version === "string" ? manifest.version : void 0;
-  } catch {
-    return void 0;
-  }
-};
-var versionOf = (moduleUrl) => {
-  let dir = dirname2(fileURLToPath3(moduleUrl));
-  for (; ; ) {
-    const found = versionIn(dir);
-    if (found !== void 0) return found;
-    const up = dirname2(dir);
-    if (up === dir) return UNKNOWN;
-    dir = up;
-  }
+  const cannot = report.unreadable.map((one) => `  ${one.why}
+`);
+  return `${said.join("")}${cannot.join("")}schema: ${report.read} of ${report.files.length} files read \u2014 ${report.findings.length} finding(s)${report.unreadable.length === 0 ? "" : `, ${report.unreadable.length} unreadable`}
+`;
 };
-var MIGRATIONS_TOOL = "release-migrations";
-var MIGRATIONS_NEXT = "geonosis-release migrations --since <ref> --json and compare `files` against `unreadable` \u2014 every added file leaves by exactly one door, and a file in one list and not the other is the accounting bug this refuses over";
-var migrationsEnvelope = (report, durationMs) => ({
-  considered: report.files.length,
-  durationMs,
-  excused: report.files.filter((one) => one.state === "excused").map((one) => ({
-    path: one.path,
-    reason: "a contract-migration marker this gate could believe"
-  })),
-  findings: [...report.refusals, ...report.markers, ...report.squawk],
-  read: report.files.filter((one) => one.state !== "excused" && one.state !== "unreadable").length,
-  refused: report.unreadable.map((one) => ({ path: one.path, reason: one.why })),
-  tool: MIGRATIONS_TOOL,
-  version: versionOf(import.meta.url)
-});
-var SCHEMA_TOOL = "release-schema";
-var SCHEMA_NEXT = "geonosis-release schema --json and compare `files` against `unreadable` \u2014 the denominator is every migration under every declared domain directory, and a file in neither list is one nothing read (#168)";
-var schemaEnvelope = (report, durationMs) => ({
-  considered: report.files.length,
-  durationMs,
-  excused: [],
-  findings: report.findings,
-  read: report.read,
-  refused: report.unreadable.map((one) => ({ path: one.path, reason: one.why })),
-  tool: SCHEMA_TOOL,
-  version: versionOf(import.meta.url)
-});
-var PUBLISHED_TOOL = "release-published";
-var PUBLISHED_NEXT = "geonosis-release published --group --json and compare `considered` against `lines` + `excused` \u2014 every manifest in the tree leaves by exactly one door, and a group announced off a sample is the failure this counts against (#147)";
-var publishedEnvelope = (report, durationMs) => ({
-  considered: report.considered,
-  durationMs,
-  excused: report.excused,
-  findings: report.lines.filter((one) => one.verdict !== "MATCH"),
-  read: report.lines.filter((one) => one.verdict !== "UNREACHABLE").length,
-  refused: report.lines.filter((one) => one.verdict === "UNREACHABLE").map((one) => ({ path: one.at, reason: one.why })),
-  tool: PUBLISHED_TOOL,
-  version: versionOf(import.meta.url)
-});
 
 // src/smoke-run.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readdirSync as readdirSync4, readFileSync as readFileSync9, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join6, relative as relative4, resolve as resolve8 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readdirSync as readdirSync4, readFileSync as readFileSync10, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join7, relative as relative4, resolve as resolve8 } from "path";
 var BASELINE_FILE = "baseline.json";
 var INSTALL = {
   bun: ["install"],
   pnpm: ["install", "--no-frozen-lockfile"]
 };
+var MANAGER_CONFIG = [".npmrc", "bunfig.toml", "pnpm-workspace.yaml"];
+var configBytesOf = (work) => Object.fromEntries(
+  MANAGER_CONFIG.filter((file) => existsSync7(join7(work, file))).map((file) => [
+    file,
+    readFileSync10(join7(work, file), "utf8")
+  ])
+);
+var editedByInstall = (before, after) => [.../* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])].filter((file) => before[file] !== after[file]).toSorted();
 var isRecord5 = (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 var readJson = (path) => {
   try {
-    return JSON.parse(readFileSync9(path, "utf8"));
+    return JSON.parse(readFileSync10(path, "utf8"));
   } catch (error) {
     throw new CannotRun(`${path} is not readable JSON: ${error.message}`);
   }
 };
 var packRc = (rc, into) => {
-  if (!existsSync6(join6(rc, "package.json"))) {
+  if (!existsSync7(join7(rc, "package.json"))) {
     throw new CannotRun(`${rc} has no package.json \u2014 that is not a workspace to pack`);
   }
   mkdirSync3(into, { recursive: true });
-  const root = readJson(join6(rc, "package.json"));
+  const root = readJson(join7(rc, "package.json"));
   const isPrivateRoot = isRecord5(root) && root["private"] === true;
   const done = spawnSync4(
     "pnpm",
@@ -1721,11 +1941,11 @@ var sourceManifests = (rc) => {
     for (const entry of readdirSync4(dir, { withFileTypes: true })) {
       if (excluded.has(entry.name)) continue;
       if (entry.isDirectory()) {
-        walk(join6(dir, entry.name));
+        walk(join7(dir, entry.name));
         continue;
       }
       if (entry.name !== "package.json") continue;
-      const manifest = readJson(join6(dir, entry.name));
+      const manifest = readJson(join7(dir, entry.name));
       if (!isRecord5(manifest) || typeof manifest["name"] !== "string") continue;
       found.push({ manifest, name: manifest["name"] });
     }
@@ -1747,9 +1967,9 @@ var OVERRIDES = "overrides:";
 var TOP_LEVEL = /^\S/;
 var KEYED = /^\s+["']?(.+?)["']?\s*:/;
 var pinsInWorkspaceYaml = (work, pins) => {
-  const at = join6(work, "pnpm-workspace.yaml");
+  const at = join7(work, "pnpm-workspace.yaml");
   const written = Object.entries(pins).map(([name, spec]) => `  '${name}': '${spec}'`);
-  const lines2 = existsSync6(at) ? readFileSync9(at, "utf8").split("\n") : [];
+  const lines2 = existsSync7(at) ? readFileSync10(at, "utf8").split("\n") : [];
   const kept = [];
   let inside = false;
   let found = false;
@@ -1768,8 +1988,8 @@ var pinsInWorkspaceYaml = (work, pins) => {
   writeFileSync4(at, body.join("\n"));
 };
 var pinsInManifest = (work, pins) => {
-  const at = join6(work, "package.json");
-  if (!existsSync6(at)) return;
+  const at = join7(work, "package.json");
+  if (!existsSync7(at)) return;
   const manifest = readJson(at);
   if (!isRecord5(manifest)) return;
   manifest["overrides"] = {
@@ -1789,8 +2009,8 @@ var rewriteManifests = (tree, manifests, packed) => {
   const byName = new Map(packed.map((one) => [one.name, one.tarball]));
   const swapped = [];
   for (const path of manifests) {
-    const at = join6(tree, path);
-    if (!existsSync6(at)) continue;
+    const at = join7(tree, path);
+    if (!existsSync7(at)) continue;
     const manifest = readJson(at);
     if (!isRecord5(manifest)) continue;
     let touched = false;
@@ -1826,19 +2046,25 @@ var runPhase = (phase, command, cwd, manager) => {
   const line = commandLine(command, manager);
   const env = {
     ...process.env,
-    PATH: `${join6(cwd, "node_modules/.bin")}:${process.env["PATH"] ?? ""}`
+    PATH: `${join7(cwd, "node_modules/.bin")}:${process.env["PATH"] ?? ""}`
   };
   const { code, output } = shellRun(line, cwd, env);
   return { code, command: line, lines: quotable(output), ok: code === 0, phase };
 };
+var commandsToRun = (record, declared) => Object.fromEntries(
+  PHASES.map((phase) => {
+    const named = declared[phase];
+    return [phase, named === void 0 ? record.commands[phase] : { exec: named }];
+  })
+);
 var smokeOver = (input) => {
   const record = readSnapshot(input.root, input.name);
   const at = snapshotDir(input.root, input.name);
-  const work = join6(at, "run");
+  const work = join7(at, "run");
   rmSync3(work, { force: true, recursive: true });
-  copyInto(join6(at, "tree"), work, new Set(EXCLUDED_DIRS));
+  copyInto(join7(at, "tree"), work, new Set(EXCLUDED_DIRS));
   ownRepository(work);
-  const packed = input.rc === void 0 ? [] : packRc(resolve8(input.rc), join6(at, "rc"));
+  const packed = input.rc === void 0 ? [] : packRc(resolve8(input.rc), join7(at, "rc"));
   const findings = input.rc === void 0 ? [] : promisedButNotPacked(resolve8(input.rc), packed);
   const swapped = rewriteManifests(
     work,
@@ -1852,6 +2078,7 @@ var smokeOver = (input) => {
   }
   overrideEveryCopy(work, record.manager, packed);
   const install = input.install ?? `${record.manager} ${INSTALL[record.manager].join(" ")}`;
+  const configBefore = configBytesOf(work);
   const installed = shellRun(install, work, process.env);
   if (installed.code !== 0) {
     throw new CannotRun(
@@ -1859,9 +2086,15 @@ var smokeOver = (input) => {
 ${quotable(installed.output).join("\n")}`
     );
   }
+  for (const file of editedByInstall(configBefore, configBytesOf(work))) {
+    findings.push(
+      `\`${install}\` rewrote ${file} in the copy \u2014 every phase below ran against a tree that is no longer byte-for-byte "${input.name}", and the same install in their own tree would edit theirs`
+    );
+  }
+  const commands = commandsToRun(record, input.commands ?? {});
   return {
     findings,
-    outcomes: PHASES.map((phase) => runPhase(phase, record.commands[phase], work, record.manager)),
+    outcomes: PHASES.map((phase) => runPhase(phase, commands[phase], work, record.manager)),
     packed
   };
 };
@@ -1873,7 +2106,7 @@ var ownRepository = (work) => {
     );
   }
 };
-var baselinePath = (root, name) => join6(snapshotDir(root, name), BASELINE_FILE);
+var baselinePath = (root, name) => join7(snapshotDir(root, name), BASELINE_FILE);
 var recordBaseline = (input) => {
   const { outcomes, packed } = smokeOver(input);
   const baseline = {
@@ -1888,7 +2121,7 @@ var recordBaseline = (input) => {
 };
 var readBaseline = (root, name) => {
   const at = baselinePath(root, name);
-  if (!existsSync6(at)) {
+  if (!existsSync7(at)) {
     throw new CannotRun(
       `"${name}" has no baseline \u2014 a run that took its own answer as the standard would certify anything. Record one against the versions this consumer is on: geonosis-release smoke baseline --snapshot ${name}`
     );
@@ -1942,57 +2175,118 @@ var runSmoke = (input) => {
   const { findings, outcomes } = smokeOver(input);
   return compareToBaseline(input.name, baseline, outcomes, findings);
 };
+var CONSUMER_TREES_FILE = ".geonosis/consumer-trees.local.json";
+var localTrees = (root) => {
+  const at = join7(root, CONSUMER_TREES_FILE);
+  if (!existsSync7(at)) return {};
+  const parsed = readJson(at);
+  if (!isRecord5(parsed)) {
+    throw new CannotRun(`${at} must be an object of { "<snapshot name>": "<absolute path>" }`);
+  }
+  return Object.fromEntries(
+    Object.entries(parsed).filter((one) => typeof one[1] === "string")
+  );
+};
+var recordedAlready = (root, name) => existsSync7(join7(snapshotDir(root, name), "snapshot.json"));
+var unrecordedButHere = (root, wanted, absent) => {
+  const trees = localTrees(root);
+  return wanted.filter((one) => !absent.includes(one.name) && !recordedAlready(root, one.name)).flatMap((one) => {
+    const path = trees[one.name];
+    if (path === void 0 || !existsSync7(path)) return [];
+    return [
+      `${one.name} is declared and its tree is here (${path}) \u2014 record it: geonosis-release smoke snapshot ${one.name} --from ${path}`
+    ];
+  });
+};
+var dating = (root, name) => {
+  const record = readSnapshot(root, name);
+  const commit = record.commit;
+  if (commit === void 0) {
+    return {
+      undated: `UNDATED ${name}: recorded before source commits were kept \u2014 re-record it: geonosis-release smoke snapshot ${name} --from ${record.from}`
+    };
+  }
+  if (!("sha" in commit) || !existsSync7(record.from)) return void 0;
+  const now = headOf(record.from);
+  if (!("sha" in now) || now.sha === commit.sha) return void 0;
+  return { stale: `STALE ${name}: recorded at ${commit.sha}, the tree is at ${now.sha}` };
+};
 var sweepSmoke = (input) => {
-  const comparisons = [];
-  const skipped = [];
-  for (const one of input.wanted) {
-    if (input.skipMissing && !existsSync6(join6(snapshotDir(input.root, one.name), "snapshot.json"))) {
-      skipped.push({
+  const absent = input.absent ?? [];
+  if (input.skipMissing) {
+    const owed = unrecordedButHere(input.root, input.wanted, absent);
+    if (owed.length > 0) throw new CannotRun(owed.join("\n"));
+  }
+  const entries = input.wanted.map((one) => {
+    if (absent.includes(one.name)) {
+      return {
+        name: one.name,
+        why: "--absent named it, so this release was not read against it"
+      };
+    }
+    if (input.skipMissing && !recordedAlready(input.root, one.name)) {
+      return {
         name: one.name,
         why: `no snapshot of it here \u2014 record one with: geonosis-release smoke snapshot ${one.name} --from <their tree>`
-      });
-      continue;
+      };
     }
-    comparisons.push(
-      runSmoke({
+    const note = dating(input.root, one.name);
+    return {
+      comparison: runSmoke({
+        ...one.commands === void 0 ? {} : { commands: one.commands },
         ...one.install === void 0 ? {} : { install: one.install },
         name: one.name,
         ...input.rc === void 0 ? {} : { rc: input.rc },
         root: input.root
-      })
-    );
+      }),
+      name: one.name,
+      ...note === void 0 ? {} : { note }
+    };
+  });
+  return { entries };
+};
+var comparisonsIn = (sweep) => sweep.entries.flatMap((one) => "comparison" in one ? [one.comparison] : []);
+var EXCUSED = "EXCUSED";
+var noteLine = (note) => "stale" in note ? note.stale : note.undated;
+var entryBlock = (entry) => {
+  if (!("comparison" in entry)) {
+    const head = entry.why.startsWith("--absent") ? EXCUSED : "SKIP  ";
+    return `${head} smoke ${entry.name}: ${entry.why}
+`;
   }
-  return { comparisons, skipped };
+  return `${formatSmoke(entry.comparison)}${entry.note === void 0 ? "" : `${noteLine(entry.note)}
+`}`;
 };
-var formatSweep = (sweep) => [
-  ...sweep.comparisons.map(formatSmoke),
-  ...sweep.skipped.map((one) => `SKIP  smoke ${one.name}: ${one.why}
-`)
-].join("");
+var formatSweep = (sweep) => sweep.entries.map(entryBlock).join("");
 var sweepEnvelope = (sweep, durationMs) => {
-  const parts = sweep.comparisons.map((one) => smokeEnvelope(one, 0));
+  const excused = [];
+  const findings = [];
+  const refused = [];
+  let considered = 0;
+  let read = 0;
+  for (const entry of sweep.entries) {
+    if (!("comparison" in entry)) {
+      considered += PHASES.length;
+      excused.push(
+        ...PHASES.map((phase) => ({ path: `${entry.name}/${phase}`, reason: entry.why }))
+      );
+      continue;
+    }
+    const part = smokeEnvelope(entry.comparison, 0);
+    considered += part.considered;
+    read += part.read;
+    excused.push(...part.excused.map((one) => ({ ...one, path: `${entry.name}/${one.path}` })));
+    refused.push(...part.refused.map((one) => ({ ...one, path: `${entry.name}/${one.path}` })));
+    findings.push(...part.findings);
+    if (entry.note !== void 0) findings.push(entry.note);
+  }
   return {
-    considered: parts.reduce((sum, one) => sum + one.considered, 0) + sweep.skipped.length * 3,
+    considered,
     durationMs,
-    excused: [
-      ...parts.flatMap(
-        (one, index) => one.excused.map((entry) => ({
-          path: `${sweep.comparisons[index]?.name ?? ""}/${entry.path}`,
-          reason: entry.reason
-        }))
-      ),
-      ...sweep.skipped.flatMap(
-        (one) => PHASES.map((phase) => ({ path: `${one.name}/${phase}`, reason: one.why }))
-      )
-    ],
-    findings: parts.flatMap((one) => one.findings),
-    read: parts.reduce((sum, one) => sum + one.read, 0),
-    refused: parts.flatMap(
-      (one, index) => one.refused.map((entry) => ({
-        path: `${sweep.comparisons[index]?.name ?? ""}/${entry.path}`,
-        reason: entry.reason
-      }))
-    ),
+    excused,
+    findings,
+    read,
+    refused,
     tool: SMOKE_TOOL,
     version: versionOf(import.meta.url)
   };
@@ -2065,6 +2359,33 @@ export {
   CannotRun,
   parseReleaseConfig,
   readReleaseConfig,
+  writeEnvelope,
+  MIGRATIONS_NEXT,
+  migrationsEnvelope,
+  SCHEMA_NEXT,
+  schemaEnvelope,
+  PUBLISHED_NEXT,
+  publishedEnvelope,
+  DEFAULT_REGISTRY,
+  registryPathOf,
+  askRegistry,
+  censusOf,
+  EXISTS_BUT,
+  runPublished,
+  formatPublished,
+  SNAPSHOTS_DIR,
+  EXCLUDED_DIRS,
+  PHASES,
+  headOf,
+  snapshotDir,
+  readSnapshot,
+  runSnapshot,
+  formatSnapshot,
+  runAdoption,
+  formatAdoption,
+  ADOPTION_TOOL,
+  ADOPTION_NEXT,
+  adoptionEnvelope,
   parseJsonc,
   parseToml,
   declaredIn,
@@ -2092,29 +2413,8 @@ export {
   prove,
   formatProve,
   formatVerdict,
-  DEFAULT_REGISTRY,
-  registryPathOf,
-  askRegistry,
-  censusOf,
-  EXISTS_BUT,
-  runPublished,
-  formatPublished,
   runSchema,
   formatSchema,
-  SNAPSHOTS_DIR,
-  EXCLUDED_DIRS,
-  PHASES,
-  snapshotDir,
-  readSnapshot,
-  runSnapshot,
-  formatSnapshot,
-  writeEnvelope,
-  MIGRATIONS_NEXT,
-  migrationsEnvelope,
-  SCHEMA_NEXT,
-  schemaEnvelope,
-  PUBLISHED_NEXT,
-  publishedEnvelope,
   BASELINE_FILE,
   packRc,
   promisedButNotPacked,
@@ -2123,7 +2423,9 @@ export {
   readBaseline,
   compareToBaseline,
   runSmoke,
+  CONSUMER_TREES_FILE,
   sweepSmoke,
+  comparisonsIn,
   formatSweep,
   sweepEnvelope,
   formatSmoke,