@intentius/chant 0.124.34 → 0.124.36

package/dist/lifecycle/publish-npm.js

@@ -42,10 +42,13 @@
  * npm makes the first version of a new package `latest` whatever tag it is
  * published under, so a package's first release is visible when it stages.
  *
- * Credentials are npm's own. chant reads no npm token and writes no `.npmrc`:
- * npm authenticates with the registry's `_authToken` in the user's or the
- * CI's npm config (`actions/setup-node` writes one that reads
- * `NODE_AUTH_TOKEN`), or by trusted publishing. npm runs with the run's
+ * Credentials are npm's own: npm authenticates with the registry's
+ * `_authToken` in the user's or the CI's npm config (`actions/setup-node`
+ * writes one that reads `NODE_AUTH_TOKEN`), or by trusted publishing. The one
+ * exception is `tokenEnv` (#4040): when a publish fails to authenticate, the
+ * package is published again with that variable's token in a throwaway npm
+ * user config, never on the command line, and without `--provenance` if the
+ * registry refuses the attestation on the token path. npm runs with the run's
  * environment, and everything it prints is redacted before chant prints it.
  */
 import { execFileSync, spawn } from "node:child_process";
@@ -55,6 +58,8 @@ import { join } from "node:path";
 import { packageSbom } from "./publish-attachments.js";
 import { checkReleaseDigest, fileDigest, isDir, memberFile, publishTargetKey } from "./publish-targets.js";
 import { NPM_STAGE_TAG, PublishTargetError } from "./release-publish.js";
+/** npm's output when a publish could not authenticate, as publish-packages.sh matches it. */
+const NPM_AUTH_FAILED = /ENEEDAUTH|E401|need auth/;
 /** Read a package's name and version, from its directory or its packed `.tgz`, and find the SBOM it carries. */
 function readPackage(ctx, path, sbom) {
     const abs = memberFile(ctx.cwd, path);
@@ -119,9 +124,9 @@ export function npmAuditInstallArgs(decl) {
 export function npmAuditSignaturesArgs(decl) {
     return ["audit", "signatures", ...(decl.registry ? ["--registry", decl.registry] : [])];
 }
-function run(bin, args, ctx, cwd = ctx.cwd) {
+function run(bin, args, ctx, cwd = ctx.cwd, env = ctx.env) {
     return new Promise((resolvePromise, reject) => {
-        const child = spawn(bin, args, { cwd, env: ctx.env, stdio: ["ignore", "pipe", "pipe"] });
+        const child = spawn(bin, args, { cwd, env, stdio: ["ignore", "pipe", "pipe"] });
         const output = [];
         let partial = { out: "", err: "" };
         const take = (key) => (chunk) => {
@@ -143,14 +148,25 @@ function run(bin, args, ctx, cwd = ctx.cwd) {
         });
     });
 }
+/** Seconds the reveal waits for the registry to serve what it published, by default (#4244). */
+export const NPM_REGISTRY_WAIT_SECONDS = 600;
+/** Between polls of the registry while it waits. */
+export const NPM_REGISTRY_POLL_MS = 10000;
+/** npm's errors for a version the registry does not serve yet. */
+const NPM_NOT_SERVED = /\b(ETARGET|ERESOLVE|notarget)\b|No matching version found/;
 export function npmTarget(decl, deps) {
     const bin = deps.npm ?? "npm";
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const now = deps.now ?? Date.now;
     const registry = decl.registry ?? "the registry npm's config names";
     const shown = (tag) => `${registry}, dist-tag ${tag}`;
     const revealTag = (ctx) => ctx.tag ?? "latest";
-    const npm = async (ctx, args, cwd) => {
+    // Under `stage: false` a package goes straight to the reveal tag, and the reveal moves no tag (#4040).
+    const staging = decl.stage !== false;
+    const stageTag = (ctx) => (staging ? NPM_STAGE_TAG : revealTag(ctx));
+    const npm = async (ctx, args, cwd, env) => {
         try {
-            return await run(bin, args, ctx, cwd);
+            return await run(bin, args, ctx, cwd, env);
         }
         catch (err) {
             throw new PublishTargetError("publish-npm-failed", ctx.redactor.redact(`npm could not be run: ${err instanceof Error ? err.message : String(err)}`), "Install npm, or put it on PATH.");
@@ -161,24 +177,90 @@ export function npmTarget(decl, deps) {
         const r = await npm(ctx, ["view", `${pkg.name}@${pkg.version}`, "version", ...(decl.registry ? ["--registry", decl.registry] : [])]);
         return r.code === 0 && r.output.some((l) => l.trim() === pkg.version || l.trim() === JSON.stringify(pkg.version));
     };
+    /**
+     * The `tokenEnv` retry (#4040): a publish that failed to authenticate runs
+     * again with the token in a throwaway user config, and once more without
+     * `--provenance` when the token path refuses the attestation.
+     */
+    const withToken = async (ctx, pkg, args, failed) => {
+        const token = decl.tokenEnv ? ctx.env[decl.tokenEnv] : undefined;
+        if (!token || !failed.output.some((l) => NPM_AUTH_FAILED.test(l)))
+            return failed;
+        ctx.log(`${pkg.name}@${pkg.version} could not authenticate; publishing again with ${decl.tokenEnv}`);
+        const dir = mkdtempSync(join(tmpdir(), "chant-npm-token-"));
+        try {
+            const userconfig = join(dir, ".npmrc");
+            const host = (decl.registry ?? "https://registry.npmjs.org/").replace(/^https?:/, "").replace(/\/?$/, "/");
+            writeFileSync(userconfig, `${host}:_authToken=${token}\n`, { mode: 0o600 });
+            const env = { ...ctx.env, NPM_CONFIG_USERCONFIG: userconfig };
+            let result = await npm(ctx, args, undefined, env);
+            for (const line of result.output)
+                ctx.log(`  ${line}`);
+            if (result.code !== 0 && args.includes("--provenance") && result.output.some((l) => /^npm (error|ERR!).*(provenance|attestation)/i.test(l))) {
+                ctx.log(`${pkg.name}@${pkg.version}: the registry refused provenance on the token path; publishing without an attestation`);
+                result = await npm(ctx, args.filter((a) => a !== "--provenance"), undefined, env);
+                for (const line of result.output)
+                    ctx.log(`  ${line}`);
+            }
+            return result;
+        }
+        finally {
+            rmSync(dir, { recursive: true, force: true });
+        }
+    };
     const read = (ctx) => decl.packages.map((p) => readPackage(ctx, p, decl.sbom));
     const extra = (pkg) => ({ ...(pkg.digest ? { digest: pkg.digest } : {}), ...(pkg.sbom ? { sbom: pkg.sbom } : {}) });
-    const plan = async (ctx) => read(ctx).map((pkg) => ({ name: `${pkg.name}@${pkg.version}`, destination: `${shown(NPM_STAGE_TAG)}, then ${revealTag(ctx)}`, ...extra(pkg) }));
+    const plan = async (ctx) => read(ctx).map((pkg) => ({ name: `${pkg.name}@${pkg.version}`, destination: staging ? `${shown(NPM_STAGE_TAG)}, then ${revealTag(ctx)}` : shown(revealTag(ctx)), ...extra(pkg) }));
     /**
      * In CI, install what was published into an empty directory and run
      * `npm audit signatures` there (#4049), which checks each package's
      * registry signature and provenance attestation.
      */
+    /**
+     * Wait until the registry serves every version (#4244): npm accepts a
+     * publish minutes before `npm view` and `npm install` find it, so an
+     * install straight after fails with ETARGET or ERESOLVE.
+     */
+    const served = async (ctx, pkgs) => {
+        const wait = (decl.registryWait ?? NPM_REGISTRY_WAIT_SECONDS) * 1000;
+        const start = now();
+        let missing = pkgs;
+        for (;;) {
+            const still = [];
+            for (const pkg of missing)
+                if (!(await onRegistry(ctx, pkg)))
+                    still.push(pkg);
+            missing = still;
+            if (missing.length === 0)
+                return;
+            const names = missing.map((p) => `${p.name}@${p.version}`).join(", ");
+            if (now() - start >= wait) {
+                throw new PublishTargetError("publish-npm-not-served", `the registry did not serve ${names} within ${Math.round(wait / 1000)}s of the publish, so nothing was audited`, "Each package was published. Once npm serves them, run the publish again: it publishes nothing twice and audits again. `registryWait` sets the wait.");
+            }
+            ctx.log(`waiting for the registry to serve ${names}`);
+            await sleep(NPM_REGISTRY_POLL_MS);
+        }
+    };
     const audit = async (ctx, pkgs) => {
+        await served(ctx, pkgs);
         const dir = mkdtempSync(join(tmpdir(), "chant-npm-audit-"));
         try {
             const dependencies = Object.fromEntries(pkgs.map((p) => [p.name, p.version]));
             writeFileSync(join(dir, "package.json"), `${JSON.stringify({ name: "chant-publish-audit", version: "0.0.0", private: true, dependencies }, null, 2)}\n`);
             for (const args of [npmAuditInstallArgs(decl), npmAuditSignaturesArgs(decl)]) {
                 ctx.log(`npm ${args.join(" ")}`);
-                const result = await npm(ctx, args, dir);
+                let result = await npm(ctx, args, dir);
                 for (const line of result.output)
                     ctx.log(`  ${line}`);
+                // `npm view` can answer before every mirror `npm install` reads does: wait once more, then install again.
+                if (result.code !== 0 && args[0] === "install" && result.output.some((l) => NPM_NOT_SERVED.test(l))) {
+                    ctx.log("the registry does not serve every version to an install yet; waiting, then installing again");
+                    await sleep(NPM_REGISTRY_POLL_MS);
+                    await served(ctx, pkgs);
+                    result = await npm(ctx, args, dir);
+                    for (const line of result.output)
+                        ctx.log(`  ${line}`);
+                }
                 if (result.code !== 0) {
                     throw new PublishTargetError("publish-npm-audit-failed", `npm ${args.slice(0, 2).join(" ")} exited ${result.code} for ${pkgs.map((p) => `${p.name}@${p.version}`).join(", ")}, after latest moved: ${result.output.at(-1) ?? "npm printed nothing"}`, "Each package was published; check its signature and provenance on the registry. Running the publish again moves no tag that moved and audits again.");
                 }
@@ -199,20 +281,22 @@ export function npmTarget(decl, deps) {
             const pkgs = read(ctx);
             const items = [];
             for (const pkg of pkgs) {
-                const item = { name: `${pkg.name}@${pkg.version}`, destination: shown(NPM_STAGE_TAG), ...extra(pkg) };
+                const item = { name: `${pkg.name}@${pkg.version}`, destination: shown(stageTag(ctx)), ...extra(pkg) };
                 if (await onRegistry(ctx, pkg)) {
                     ctx.log(`${item.name} is already on the registry; not published again`);
                     items.push({ ...item, present: true });
                     continue;
                 }
-                const args = npmPublishArgs(decl, pkg.abs, ctx);
+                const args = npmPublishArgs(decl, pkg.abs, ctx, stageTag(ctx));
                 ctx.log(`npm publish ${pkg.path} ${args.slice(2).join(" ")}`);
-                const result = await npm(ctx, args);
+                let result = await npm(ctx, args);
                 for (const line of result.output)
                     ctx.log(`  ${line}`);
+                if (result.code !== 0)
+                    result = await withToken(ctx, pkg, args, result);
                 if (result.code !== 0) {
                     const done = items.map((i) => i.name);
-                    throw new PublishTargetError("publish-npm-failed", `npm publish of ${item.name} exited ${result.code}${done.length > 0 ? `, after ${done.join(", ")} were staged under ${NPM_STAGE_TAG}` : ", before any package was staged"}: ${result.output.at(-1) ?? "npm printed nothing"}`);
+                    throw new PublishTargetError("publish-npm-failed", `npm publish of ${item.name} exited ${result.code}${done.length > 0 ? `, after ${done.join(", ")} were ${staging ? "staged" : "published"} under ${stageTag(ctx)}` : `, before any package was ${staging ? "staged" : "published"}`}: ${result.output.at(-1) ?? "npm printed nothing"}`);
                 }
                 items.push(item);
             }
@@ -222,6 +306,12 @@ export function npmTarget(decl, deps) {
             const tag = revealTag(ctx);
             const pkgs = read(ctx);
             const items = [];
+            if (!staging) {
+                // Already under the reveal tag since the stage; only the audit is left.
+                if (ctx.provenance.oidc)
+                    await audit(ctx, pkgs);
+                return { target: this.name, destination: this.destination, items: pkgs.map((pkg) => ({ name: `${pkg.name}@${pkg.version}`, destination: shown(tag), ...extra(pkg) })) };
+            }
             // The declared order: the first package is the set's core, and its tag moves first.
             for (const pkg of pkgs) {
                 const args = npmDistTagArgs(decl, pkg.name, pkg.version, tag);

package/dist/lifecycle/release-compose.d.ts

@@ -0,0 +1,91 @@
+/**
+ * `chant release compose` (#4168 4.3, mode b): a release of chosen changes
+ * on a base, when trunk carries work that is not ready to ship.
+ *
+ * The changes are named by pull request (`--pr <n>`) or work item
+ * (`--work <id>`) and found on trunk's first-parent line after the base:
+ * a pull request by the merge record `_merges/<sha>.json` on
+ * `chant/lifecycle` (./merge-record.ts) or the squash subject `... (#n)`,
+ * a work item by the commit's `Chant-Record: work:<id>` trailers or a merge
+ * record that names it. Each commit is cherry-picked in trunk order onto the
+ * base, in a temporary detached worktree, with a `Chant-Composed-From: <sha>`
+ * trailer, and the result goes on the branch `chant/compose/<name>`, pushed
+ * so the forge's CI builds it (decision 6).
+ *
+ * It only appends. A branch that exists is composed onto from its tip, with
+ * the base it already has; a change it already carries is skipped. On a
+ * conflict it stops, names the change and the files, and writes nothing: a
+ * person resolves it in a pull request to the compose branch.
+ *
+ * Without `yes` it is a dry run: the picks are made in the temporary
+ * worktree, so a conflict shows now, and no ref is moved or pushed.
+ */
+export type ComposeCode = "not-a-git-repository" | "compose-name-invalid" | "compose-nothing-chosen" | "compose-base-unknown" | "compose-base-differs" | "compose-branch-diverged" | "compose-source-unknown" | "compose-conflict" | "compose-push-refused";
+export declare class ComposeError extends Error {
+    readonly code: ComposeCode;
+    readonly fix?: string | undefined;
+    /** With `compose-conflict`: the change that did not apply and the files it conflicts in. */
+    readonly conflict?: {
+        commit: string;
+        subject: string;
+        files: string[];
+    } | undefined;
+    constructor(code: ComposeCode, message: string, fix?: string | undefined, 
+    /** With `compose-conflict`: the change that did not apply and the files it conflicts in. */
+    conflict?: {
+        commit: string;
+        subject: string;
+        files: string[];
+    } | undefined);
+}
+export interface ComposeRequest {
+    cwd: string;
+    name: string;
+    /** A release label or digest, or a commit. Required when the branch does not exist yet. */
+    base?: string;
+    prs: readonly number[];
+    works: readonly string[];
+    /** Move the branch and push it. Otherwise a dry run. */
+    yes: boolean;
+    /** The trunk branch, `ci.green.branch` as the cut resolves it. */
+    trunk: {
+        remote: string;
+        branch: string;
+    };
+    /** Push the branch to the trunk's remote with `yes`. Default true. */
+    push?: boolean;
+}
+/** One trunk commit a compose picks, and why. */
+export interface ComposeSource {
+    commit: string;
+    subject: string;
+    pr: number | null;
+    work: string[];
+    /** The `--pr` and `--work` values that chose it. */
+    chosenBy: string[];
+}
+export interface ComposeResult {
+    name: string;
+    branch: string;
+    base: string;
+    /** The branch's tip before the compose, or null when it is new. */
+    from: string | null;
+    /** The commits picked now, in trunk order. */
+    picked: ComposeSource[];
+    /** Chosen commits the branch already carries. */
+    already: ComposeSource[];
+    /** The branch's tip after the picks. Under a dry run, the tip it would have. */
+    tip: string;
+    /** Whether the branch was moved here. False under a dry run. */
+    written: boolean;
+    /** Whether it was pushed. */
+    pushed: boolean;
+}
+/** The branch a compose name lives on. */
+export declare function composeBranchName(name: string): string;
+/**
+ * Compose the chosen changes onto the base, on `chant/compose/<name>`.
+ * Throws {@link ComposeError} before any ref moves.
+ */
+export declare function composeRelease(req: ComposeRequest): Promise<ComposeResult>;
+//# sourceMappingURL=release-compose.d.ts.map

package/dist/lifecycle/release-compose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-compose.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-compose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAQH,MAAM,MAAM,WAAW,GACnB,sBAAsB,GACtB,sBAAsB,GACtB,wBAAwB,GACxB,sBAAsB,GACtB,sBAAsB,GACtB,yBAAyB,GACzB,wBAAwB,GACxB,kBAAkB,GAClB,sBAAsB,CAAC;AAE3B,qBAAa,YAAa,SAAQ,KAAK;IAEnC,QAAQ,CAAC,IAAI,EAAE,WAAW;IAE1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE;IAL1E,YACW,IAAI,EAAE,WAAW,EAC1B,OAAO,EAAE,MAAM,EACN,GAAG,CAAC,EAAE,MAAM,YAAA;IACrB,4FAA4F;IACnF,QAAQ,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,YAAA,EAIzE;CACF;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;IACvB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,wDAAwD;IACxD,GAAG,EAAE,OAAO,CAAC;IACb,kEAAkE;IAClE,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,oDAAoD;IACpD,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,8CAA8C;IAC9C,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,iDAAiD;IACjD,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAC;IACjB,6BAA6B;IAC7B,MAAM,EAAE,OAAO,CAAC;CACjB;AAmBD,0CAA0C;AAC1C,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAsCD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAkHhF"}

package/dist/lifecycle/release-compose.js

@@ -0,0 +1,235 @@
+/**
+ * `chant release compose` (#4168 4.3, mode b): a release of chosen changes
+ * on a base, when trunk carries work that is not ready to ship.
+ *
+ * The changes are named by pull request (`--pr <n>`) or work item
+ * (`--work <id>`) and found on trunk's first-parent line after the base:
+ * a pull request by the merge record `_merges/<sha>.json` on
+ * `chant/lifecycle` (./merge-record.ts) or the squash subject `... (#n)`,
+ * a work item by the commit's `Chant-Record: work:<id>` trailers or a merge
+ * record that names it. Each commit is cherry-picked in trunk order onto the
+ * base, in a temporary detached worktree, with a `Chant-Composed-From: <sha>`
+ * trailer, and the result goes on the branch `chant/compose/<name>`, pushed
+ * so the forge's CI builds it (decision 6).
+ *
+ * It only appends. A branch that exists is composed onto from its tip, with
+ * the base it already has; a change it already carries is skipped. On a
+ * conflict it stops, names the change and the files, and writes nothing: a
+ * person resolves it in a pull request to the compose branch.
+ *
+ * Without `yes` it is a dry run: the picks are made in the temporary
+ * worktree, so a conflict shows now, and no ref is moved or pushed.
+ */
+import { execFileSync, spawnSync } from "node:child_process";
+import { mkdtempSync, realpathSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { COMPOSE_BRANCH_PREFIX, COMPOSED_FROM_TRAILER, compositionOnTrunk } from "./compose-refs.js";
+export class ComposeError extends Error {
+    constructor(code, message, fix, 
+    /** With `compose-conflict`: the change that did not apply and the files it conflicts in. */
+    conflict) {
+        super(message);
+        this.code = code;
+        this.fix = fix;
+        this.conflict = conflict;
+        this.name = "ComposeError";
+    }
+}
+const NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const PR_IN_SUBJECT = /\(#(\d+)\)\s*$/;
+function git(cwd, args, env) {
+    return execFileSync("git", args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], maxBuffer: 64 * 1024 * 1024, ...(env ? { env } : {}) }).trim();
+}
+function tryGit(cwd, args) {
+    try {
+        return git(cwd, args);
+    }
+    catch {
+        return null;
+    }
+}
+const isAncestor = (top, a, b) => spawnSync("git", ["merge-base", "--is-ancestor", a, b], { cwd: top, stdio: "ignore" }).status === 0;
+/** The branch a compose name lives on. */
+export function composeBranchName(name) {
+    return `${COMPOSE_BRANCH_PREFIX}${name}`;
+}
+async function resolveBase(top, cwd, ref) {
+    const { resolveRelease } = await import("./release-store.js");
+    const found = await resolveRelease(ref, { cwd }).catch(() => null);
+    if (found)
+        return found.release.commit;
+    const sha = tryGit(top, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]);
+    if (!sha) {
+        throw new ComposeError("compose-base-unknown", `--base ${ref} names no release of this member and no commit this clone has`, "Name a release label (chant release list) or a commit, after fetching it.");
+    }
+    return sha;
+}
+/** The merge record of `sha`, as stored, or null. */
+async function mergeRecordOf(cwd, sha) {
+    const { readBlobFromPath } = await import("./git.js");
+    const text = await readBlobFromPath("_merges", `${sha}.json`, { cwd }).catch(() => null);
+    if (text === null)
+        return null;
+    try {
+        const parsed = JSON.parse(text);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The pull request and work items a merge record names. */
+function fromMergeRecord(merge) {
+    if (!merge)
+        return { pr: null, work: [] };
+    const source = merge.source;
+    const pr = source?.kind === "pull-request" && typeof source.pr === "number" ? source.pr : typeof merge.pr === "number" ? merge.pr : null;
+    const work = source?.kind === "work-item" && Array.isArray(source.records)
+        ? source.records.filter((r) => !!r && typeof r === "object" && r.kind === "work").map((r) => r.id)
+        : [];
+    return { pr, work };
+}
+/**
+ * Compose the chosen changes onto the base, on `chant/compose/<name>`.
+ * Throws {@link ComposeError} before any ref moves.
+ */
+export async function composeRelease(req) {
+    const top = tryGit(req.cwd, ["rev-parse", "--show-toplevel"]);
+    if (!top)
+        throw new ComposeError("not-a-git-repository", "a compose picks commits, and this directory is not in a git repository");
+    if (!NAME.test(req.name)) {
+        throw new ComposeError("compose-name-invalid", `"${req.name}" can't name a compose branch: use letters, digits, dots, dashes and underscores, starting with a letter or digit`);
+    }
+    if (req.prs.length === 0 && req.works.length === 0) {
+        throw new ComposeError("compose-nothing-chosen", "a compose needs the changes it carries", "Name them: --pr <n> or --work <id>, each as often as needed.");
+    }
+    const { remote } = req.trunk;
+    const branch = composeBranchName(req.name);
+    const remoteRef = `refs/remotes/${remote}/${branch}`;
+    const localRef = `refs/heads/${branch}`;
+    // The branch as the remote has it, when the remote is reachable; a new branch is absent there.
+    if (tryGit(top, ["remote", "get-url", remote]) !== null)
+        tryGit(top, ["fetch", "--quiet", "--no-tags", remote, `+${localRef}:${remoteRef}`]);
+    const remoteTip = tryGit(top, ["rev-parse", "--verify", "--quiet", `${remoteRef}^{commit}`]);
+    const localTip = tryGit(top, ["rev-parse", "--verify", "--quiet", `${localRef}^{commit}`]);
+    if (remoteTip && localTip && !isAncestor(top, localTip, remoteTip) && !isAncestor(top, remoteTip, localTip)) {
+        throw new ComposeError("compose-branch-diverged", `${branch} here and on ${remote} have diverged, and a compose only appends`, `Keep the remote's: git branch -f ${branch} ${remote}/${branch}`);
+    }
+    const from = remoteTip && localTip ? (isAncestor(top, localTip, remoteTip) ? remoteTip : localTip) : (remoteTip ?? localTip);
+    const trunkRef = tryGit(top, ["rev-parse", "--verify", "--quiet", `refs/remotes/${remote}/${req.trunk.branch}^{commit}`]) ??
+        tryGit(top, ["rev-parse", "--verify", "--quiet", `refs/heads/${req.trunk.branch}^{commit}`]);
+    if (!trunkRef)
+        throw new ComposeError("compose-source-unknown", `this clone has neither ${remote}/${req.trunk.branch} nor ${req.trunk.branch}, so there is no trunk to pick from`);
+    // What the branch carries: back to trunk, past a commit a person made on it, such as a resolved conflict.
+    const existing = from ? compositionOnTrunk(top, from, trunkRef, branch) : null;
+    let base;
+    if (from) {
+        base = existing?.base ?? from;
+        if (req.base !== undefined) {
+            const asked = await resolveBase(top, req.cwd, req.base);
+            if (asked !== base) {
+                throw new ComposeError("compose-base-differs", `${branch} is composed on ${base.slice(0, 12)}, and --base names ${asked.slice(0, 12)}; a compose only appends to its branch`, `Drop --base to add to ${branch}, or compose under another name.`);
+            }
+        }
+    }
+    else {
+        if (req.base === undefined)
+            throw new ComposeError("compose-base-unknown", `${branch} does not exist yet, so the compose needs --base`, "Name the release or commit to compose on: --base <label|sha>");
+        base = await resolveBase(top, req.cwd, req.base);
+    }
+    // Trunk's first-parent commits after the base, oldest first.
+    const line = (tryGit(top, ["rev-list", "--first-parent", "--reverse", trunkRef, `^${base}`]) ?? "").split("\n").filter(Boolean);
+    const { commitDetails } = await import("../workspace/intent.js");
+    const { recordTrailers } = await import("../workspace/release-candidates.js");
+    const details = commitDetails(top, line);
+    const chosen = new Map();
+    const choose = (sha, by, pr, work) => {
+        const entry = chosen.get(sha) ?? { commit: sha, subject: details.get(sha)?.subject ?? "", pr, work, chosenBy: [] };
+        if (!entry.chosenBy.includes(by))
+            entry.chosenBy.push(by);
+        chosen.set(sha, entry);
+    };
+    const unmatched = new Set([...req.prs.map((n) => `--pr ${n}`), ...req.works.map((w) => `--work ${w}`)]);
+    for (const sha of line) {
+        const d = details.get(sha);
+        const merge = fromMergeRecord(await mergeRecordOf(req.cwd, sha));
+        const subjectPr = PR_IN_SUBJECT.exec(d?.subject ?? "");
+        const pr = merge.pr ?? (subjectPr ? Number(subjectPr[1]) : null);
+        const work = [...new Set([...recordTrailers(d?.trailers ?? {}).work, ...merge.work])];
+        for (const n of req.prs) {
+            if (pr === n) {
+                choose(sha, `--pr ${n}`, pr, work);
+                unmatched.delete(`--pr ${n}`);
+            }
+        }
+        for (const w of req.works) {
+            if (work.includes(w)) {
+                choose(sha, `--work ${w}`, pr, work);
+                unmatched.delete(`--work ${w}`);
+            }
+        }
+    }
+    if (unmatched.size > 0) {
+        throw new ComposeError("compose-source-unknown", `${[...unmatched].join(", ")} names no commit on ${remote}/${req.trunk.branch} after ${base.slice(0, 12)}`, "A pull request is found by its merge record or its squash subject (#n), and a work item by a Chant-Record: work:<id> trailer. Fetch trunk and chant/lifecycle if it merged elsewhere.");
+    }
+    // Trunk order, and what the branch already carries.
+    const carried = new Set(existing?.sources ?? []);
+    const ordered = line.filter((sha) => chosen.has(sha)).map((sha) => chosen.get(sha));
+    const already = ordered.filter((s) => carried.has(s.commit));
+    const picked = ordered.filter((s) => !carried.has(s.commit));
+    const tip = picked.length === 0 ? (from ?? base) : pickOnto(top, from ?? base, picked);
+    let written = false;
+    let pushed = false;
+    if (req.yes && picked.length > 0) {
+        git(top, ["update-ref", "-m", `chant release compose ${req.name}`, localRef, tip, localTip ?? ""]);
+        written = true;
+    }
+    if (req.yes && (req.push ?? true) && tryGit(top, ["remote", "get-url", remote]) !== null && tip !== remoteTip) {
+        try {
+            git(top, ["push", "--quiet", remote, `${tip}:${localRef}`]);
+            tryGit(top, ["update-ref", remoteRef, tip]);
+            pushed = true;
+        }
+        catch (err) {
+            const stderr = err.stderr?.toString().trim() ?? String(err);
+            throw new ComposeError("compose-push-refused", `${branch} was composed here at ${tip.slice(0, 12)} and ${remote} refused the push: ${stderr}`, `Push it by hand once the remote allows it: git push ${remote} ${branch}`);
+        }
+    }
+    return { name: req.name, branch, base, from, picked, already, tip, written, pushed };
+}
+/**
+ * Cherry-pick `sources` in order onto `start` in a temporary detached
+ * worktree, each with its trailer, and return the last commit. Throws
+ * `compose-conflict` naming the change and its files when one does not
+ * apply. The worktree is removed either way.
+ */
+function pickOnto(top, start, sources) {
+    const realTop = realpathSync(top);
+    const dir = mkdtempSync(join(tmpdir(), "chant-compose-"));
+    git(realTop, ["worktree", "add", "--detach", "--quiet", dir, start]);
+    try {
+        for (const s of sources) {
+            const parents = (tryGit(dir, ["rev-list", "--parents", "-n", "1", s.commit]) ?? "").split(" ").length - 1;
+            const args = ["cherry-pick", "--allow-empty", "--keep-redundant-commits", ...(parents > 1 ? ["-m", "1"] : []), s.commit];
+            const run = spawnSync("git", args, { cwd: dir, encoding: "utf-8" });
+            if (run.status !== 0) {
+                const files = (tryGit(dir, ["diff", "--name-only", "--diff-filter=U"]) ?? "").split("\n").filter(Boolean);
+                tryGit(dir, ["cherry-pick", "--abort"]);
+                const what = [s.pr !== null ? `#${s.pr}` : null, ...s.work.map((w) => `work:${w}`)].filter(Boolean).join(", ");
+                throw new ComposeError("compose-conflict", `${s.commit.slice(0, 12)} (${s.subject}${what ? `; ${what}` : ""}) does not apply on the composed commits${files.length > 0 ? `: it conflicts in ${files.join(", ")}` : `: ${(run.stderr || run.stdout).trim()}`}. Nothing was written`, "Resolve it by hand in a pull request to the compose branch, or compose without that change.", { commit: s.commit, subject: s.subject, files });
+            }
+            git(dir, ["commit", "--quiet", "--amend", "--no-edit", "--allow-empty", "--no-verify", "--trailer", `${COMPOSED_FROM_TRAILER}: ${s.commit}`]);
+        }
+        return git(dir, ["rev-parse", "HEAD"]);
+    }
+    finally {
+        try {
+            git(realTop, ["worktree", "remove", "--force", dir]);
+        }
+        catch {
+            rmSync(dir, { recursive: true, force: true });
+            tryGit(realTop, ["worktree", "prune"]);
+        }
+    }
+}

package/dist/lifecycle/release-cut.d.ts

@@ -60,6 +60,14 @@ export interface CutRequest {
      * must be the principal the signers file lists the key for.
      */
     sign?: string | true;
+    /** The composition of a composed commit (#4168 4.3), recorded on the cut. */
+    composed?: {
+        branch: string;
+        base: string;
+        sources: string[];
+    };
+    /** The publish channel recorded on the cut (#4168 4.3), in place of `latest`. */
+    channel?: string;
 }
 export interface CutResult {
     release: Release;

package/dist/lifecycle/release-cut.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-cut.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-cut.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AASH,OAAO,EAUL,KAAK,OAAO,EAEZ,KAAK,UAAU,EACf,KAAK,aAAa,EAGnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEpF,2CAA2C;AAC3C,MAAM,MAAM,cAAc,GACtB,sBAAsB,GACtB,0BAA0B,GAC1B,wBAAwB,GACxB,wBAAwB,GACxB,yBAAyB,GACzB,uBAAuB,GACvB,6BAA6B,GAC7B,kBAAkB,GAClB,wBAAwB,GACxB,qBAAqB,CAAC;AAE1B,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,IAAI,EAAE,cAAc;IAE7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAHvB,YACW,IAAI,EAAE,cAAc,EAC7B,OAAO,EAAE,MAAM,EACN,GAAG,CAAC,EAAE,MAAM,YAAA,EAItB;CACF;AAED,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,cAAc,CAAC;IACzB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACvB,yCAAyC;IACzC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4EAA4E;IAC5E,MAAM,EAAE,OAAO,CAAC;IAChB,oGAAoG;IACpG,MAAM,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD;AAcD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,GAAE,OAAO,0BAA0B,EAAE,OAAO,GAAG,IAAW,GAC9D,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAanH;AAED,uGAAuG;AACvG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAapH;AAoLD,6GAA6G;AAC7G,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,8GAA8G;IAC9G,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4HAA4H;IAC5H,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sFAAsF;IACtF,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;QAAC,SAAS,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/H,2FAA2F;IAC3F,KAAK,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,+EAA+E;IAC/E,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC5B,oFAAoF;IACpF,YAAY,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC5F,wEAAwE;IACxE,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CA4DnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA6DpE"}
+{"version":3,"file":"release-cut.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-cut.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AASH,OAAO,EAUL,KAAK,OAAO,EAEZ,KAAK,UAAU,EACf,KAAK,aAAa,EAGnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEpF,2CAA2C;AAC3C,MAAM,MAAM,cAAc,GACtB,sBAAsB,GACtB,0BAA0B,GAC1B,wBAAwB,GACxB,wBAAwB,GACxB,yBAAyB,GACzB,uBAAuB,GACvB,6BAA6B,GAC7B,kBAAkB,GAClB,wBAAwB,GACxB,qBAAqB,CAAC;AAE1B,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,IAAI,EAAE,cAAc;IAE7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAHvB,YACW,IAAI,EAAE,cAAc,EAC7B,OAAO,EAAE,MAAM,EACN,GAAG,CAAC,EAAE,MAAM,YAAA,EAItB;CACF;AAED,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,cAAc,CAAC;IACzB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC/D,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACvB,yCAAyC;IACzC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4EAA4E;IAC5E,MAAM,EAAE,OAAO,CAAC;IAChB,oGAAoG;IACpG,MAAM,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD;AAcD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,GAAE,OAAO,0BAA0B,EAAE,OAAO,GAAG,IAAW,GAC9D,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAanH;AAED,uGAAuG;AACvG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAapH;AAoLD,6GAA6G;AAC7G,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,8GAA8G;IAC9G,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4HAA4H;IAC5H,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sFAAsF;IACtF,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;QAAC,SAAS,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/H,2FAA2F;IAC3F,KAAK,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,+EAA+E;IAC/E,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC5B,oFAAoF;IACpF,YAAY,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC5F,wEAAwE;IACxE,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CA4DnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA+DpE"}

package/dist/lifecycle/release-cut.js

@@ -366,6 +366,8 @@ export async function cutRelease(req) {
         runId: ci?.runId ?? `local-${Date.parse(timestamp)}`,
         runOrigin: ci?.runOrigin ?? { forge: "local" },
         signature,
+        ...(req.composed ? { composed: req.composed } : {}),
+        ...(req.channel ? { channel: req.channel } : {}),
     }, { cwd });
     return {
         release,

package/dist/lifecycle/release-publish.d.ts

@@ -108,6 +108,10 @@ export interface PublishDeps {
     fetch?: PublishFetch;
     /** The npm executable. Default: `npm` on `PATH`. */
     npm?: string;
+    /** How a target waits between polls of a registry (#4244). Default: a timer. */
+    sleep?: (ms: number) => Promise<void>;
+    /** The clock a target's wait reads (#4244). Default: `Date.now`. */
+    now?: () => number;
 }
 /** The subset of the WHATWG `fetch` the targets use. */
 export type PublishFetch = (url: string, init: {
@@ -245,6 +249,8 @@ export interface PublishPlan {
     redactor: Redactor;
     /** Whether a target with no SBOM source is refused (`publish-sbom-missing`): the workspace opts into `supply-chain` (#4168). Otherwise it publishes without one. */
     requireSbom: boolean;
+    /** The channel a cut of the release names (#4168 4.3), the tag moved in place of `latest`, or null. */
+    channel: string | null;
 }
 /**
  * Resolve `ref` (a label or a digest) in the member at `cwd` and decide

package/dist/lifecycle/release-publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-publish.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtE,0FAA0F;AAC1F,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,IAAI,EAAE,OAAO,CAAC;IACd,sDAAsD;IACtD,EAAE,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC/B,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,eAAe,CAYtF;AAED,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kHAAkH;IAClH,UAAU,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IACnC,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,6GAA6G;AAC7G,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,iCAAiC;AACjC,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAED,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,kFAAkF;IAClF,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wDAAwD;AACxD,MAAM,MAAM,YAAY,GAAG,CACzB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAAE,KAClH,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAEtH,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kIAAkI;IAClI,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,eAAe,CAAC;IAC5B,oGAAoG;IACpG,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,6FAA6F;IAC7F,QAAQ,EAAE,QAAQ,CAAC;IACnB,wDAAwD;IACxD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wEAAwE;AACxE,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,IAAI,EAAE,MAAM;IAErB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAHvB,YACW,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACN,GAAG,CAAC,EAAE,MAAM,YAAA,EAItB;CACF;AAED,4HAA4H;AAC5H,eAAO,MAAM,aAAa,SAAS,CAAC;AAEpC;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,gCAAgC;IAChC,IAAI,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;IAC9B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,kGAAkG;IAClG,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,IAAI,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD;;;;;;OAMG;IACH,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC7E;AAED,iGAAiG;AACjG,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAKzG;AAED,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,IAAI,EACA,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,8BAA8B,GAC9B,4BAA4B,GAC5B,wBAAwB,GACxB,uBAAuB,GACvB,wBAAwB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,8GAA8G;AAC9G,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,6EAA6E;IAC7E,SAAS,EAAE;QAAE,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,YAAY,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxH,UAAU,EAAE,eAAe,CAAC;IAC5B,gIAAgI;IAChI,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mHAAmH;IACnH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,mGAAmG;IACnG,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACvB,iEAAiE;IACjE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,EAAE,QAAQ,CAAC;IACnB,oKAAoK;IACpK,WAAW,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,GAAG,OAAO,CAAC,WAAW,GAAG;IAAE,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC,CAuGrD;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAmBvG;AAUD,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GAAG,cAAc,CAcjK;AAED,mCAAmC;AACnC,MAAM,WAAW,UAAU;IACzB,oDAAoD;IACpD,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,+FAA+F;IAC/F,OAAO,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAA;KAAE,CAAC,CAAC;IAChE,2GAA2G;IAC3G,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,0GAA0G;AAC1G,qBAAa,eAAgB,SAAQ,kBAAkB;IAKnD,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE;IAN7B,YACE,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GAAG,SAAS,EACd,IAAI,EAAE,OAAO,GAAG,QAAQ,EACxB,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,EAAE,MAAM,EAAE,EAI5B;CACF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAClC,GAAG,EAAE,cAAc,CAAC;IACpB,sCAAsC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,GAAG,OAAO,CAAC,UAAU,CAAC,CAiFtB"}
+{"version":3,"file":"release-publish.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtE,0FAA0F;AAC1F,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,IAAI,EAAE,OAAO,CAAC;IACd,sDAAsD;IACtD,EAAE,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC/B,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,eAAe,CAYtF;AAED,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kHAAkH;IAClH,UAAU,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IACnC,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,6GAA6G;AAC7G,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,iCAAiC;AACjC,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAED,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,kFAAkF;IAClF,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,wDAAwD;AACxD,MAAM,MAAM,YAAY,GAAG,CACzB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAAE,KAClH,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAEtH,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kIAAkI;IAClI,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,eAAe,CAAC;IAC5B,oGAAoG;IACpG,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,6FAA6F;IAC7F,QAAQ,EAAE,QAAQ,CAAC;IACnB,wDAAwD;IACxD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wEAAwE;AACxE,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,IAAI,EAAE,MAAM;IAErB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAHvB,YACW,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACN,GAAG,CAAC,EAAE,MAAM,YAAA,EAItB;CACF;AAED,4HAA4H;AAC5H,eAAO,MAAM,aAAa,SAAS,CAAC;AAEpC;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,gCAAgC;IAChC,IAAI,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;IAC9B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,kGAAkG;IAClG,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,IAAI,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD;;;;;;OAMG;IACH,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC7E;AAED,iGAAiG;AACjG,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAKzG;AAED,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,IAAI,EACA,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,8BAA8B,GAC9B,4BAA4B,GAC5B,wBAAwB,GACxB,uBAAuB,GACvB,wBAAwB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,8GAA8G;AAC9G,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,6EAA6E;IAC7E,SAAS,EAAE;QAAE,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,YAAY,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxH,UAAU,EAAE,eAAe,CAAC;IAC5B,gIAAgI;IAChI,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mHAAmH;IACnH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,mGAAmG;IACnG,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACvB,iEAAiE;IACjE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,EAAE,QAAQ,CAAC;IACnB,oKAAoK;IACpK,WAAW,EAAE,OAAO,CAAC;IACrB,uGAAuG;IACvG,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,GAAG,OAAO,CAAC,WAAW,GAAG;IAAE,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC,CAwGrD;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAmBvG;AAUD,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GAAG,cAAc,CAcjK;AAED,mCAAmC;AACnC,MAAM,WAAW,UAAU;IACzB,oDAAoD;IACpD,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,+FAA+F;IAC/F,OAAO,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAA;KAAE,CAAC,CAAC;IAChE,2GAA2G;IAC3G,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,0GAA0G;AAC1G,qBAAa,eAAgB,SAAQ,kBAAkB;IAKnD,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE;IAN7B,YACE,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GAAG,SAAS,EACd,IAAI,EAAE,OAAO,GAAG,QAAQ,EACxB,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,EAAE,MAAM,EAAE,EAI5B;CACF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAClC,GAAG,EAAE,cAAc,CAAC;IACpB,sCAAsC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,GAAG,OAAO,CAAC,UAAU,CAAC,CAiFtB"}

package/dist/lifecycle/release-publish.js

@@ -189,7 +189,8 @@ export async function preparePublish(req) {
     const member = ledger.members.length > 0 ? ledger.members.join("/") : null;
     const releaseTag = label !== null ? releaseTagName(member, label) : null;
     const redactor = createRedactor(env, targets.flatMap((t) => t.credentialEnv));
-    return { release, label, signature, provenance, warning, signatureWarning, cut, releaseTag, targets, redactor, requireSbom: groups.has("supply-chain") };
+    const channel = [...cuts].reverse().find((c) => c.channel)?.channel ?? null;
+    return { release, label, signature, provenance, warning, signatureWarning, cut, releaseTag, targets, redactor, requireSbom: groups.has("supply-chain"), channel };
 }
 /**
  * A publish with a target reads files from the checkout it runs in: package