@izykitten/ce 0.0.1 → 0.0.3-dev.0

package/dist/ce.js

@@ -0,0 +1,1456 @@
+// src/command.ts
+var VALUE_OPTIONS = {
+  docker: {
+    long: new Set(["config", "context", "host", "log-level", "tlscacert", "tlscert", "tlskey", "builder"]),
+    short: "cHl"
+  },
+  podman: {
+    long: new Set([
+      "cdi-spec-dir",
+      "cgroup-manager",
+      "cni-config-dir",
+      "config",
+      "conmon",
+      "connection",
+      "context",
+      "cpu-profile",
+      "db-backend",
+      "default-mounts-file",
+      "events-backend",
+      "hooks-dir",
+      "host",
+      "identity",
+      "imagestore",
+      "log-level",
+      "max-workers",
+      "memory-profile",
+      "module",
+      "namespace",
+      "network-backend",
+      "network-cmd-path",
+      "network-config-dir",
+      "out",
+      "pull-option",
+      "registries-conf",
+      "root",
+      "runroot",
+      "runtime",
+      "runtime-flag",
+      "ssh",
+      "storage-driver",
+      "storage-opt",
+      "tmpdir",
+      "url",
+      "volumepath"
+    ]),
+    short: "cH"
+  },
+  buildah: {
+    long: new Set([
+      "cgroup-manager",
+      "cpu-profile",
+      "default-mounts-file",
+      "experimental-timeout",
+      "imagestore",
+      "log-level",
+      "memory-profile",
+      "registries-conf",
+      "registries-conf-dir",
+      "root",
+      "runroot",
+      "short-name-alias-conf",
+      "storage-driver",
+      "storage-opt",
+      "userns-gid-map",
+      "userns-uid-map"
+    ]),
+    short: ""
+  }
+};
+function takesNext(engine, arg) {
+  const options = VALUE_OPTIONS[engine];
+  if (arg.startsWith("--"))
+    return options.long.has(arg.slice(2));
+  for (let j = 1;j < arg.length; j++) {
+    if (options.short.includes(arg[j]))
+      return j === arg.length - 1;
+  }
+  return false;
+}
+var COMMANDS = {
+  docker: [
+    { words: ["build"] },
+    { words: ["image", "build"] },
+    { words: ["builder", "build"] },
+    { words: ["buildx", "build"] },
+    { words: ["buildx", "b"] },
+    { words: ["buildx", "imagetools", "create"], tagsOnly: true }
+  ],
+  podman: [{ words: ["build"] }, { words: ["image", "build"] }, { words: ["buildx", "build"] }],
+  buildah: [{ words: ["build"] }, { words: ["bud"] }]
+};
+function findBuildCommand(engine, argv) {
+  const words = [];
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--")
+      return null;
+    if (arg.startsWith("-")) {
+      if (takesNext(engine, arg))
+        i++;
+      continue;
+    }
+    words.push(arg);
+    const candidates = COMMANDS[engine].filter((command) => words.every((word, j) => command.words[j] === word));
+    const match = candidates.find((command) => command.words.length === words.length);
+    if (match)
+      return { start: i + 1, name: arg, tagsOnly: match.tagsOnly ?? false };
+    if (!candidates.length)
+      return null;
+  }
+  return null;
+}
+
+// src/errors.ts
+class CeError extends Error {
+  name = "CeError";
+}
+function isErrno(exc, code) {
+  if (!(exc instanceof Error))
+    return false;
+  const actual = exc.code;
+  return typeof actual === "string" && (code === undefined || actual === code);
+}
+function errorMessage(exc) {
+  return exc instanceof Error ? exc.message : String(exc);
+}
+
+// src/json.ts
+import { randomUUID } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readJsonFile(file, fallback) {
+  try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(fs.readFileSync(file)));
+  } catch (exc) {
+    if (isErrno(exc, "ENOENT"))
+      return fallback;
+    throw new CeError(`cannot read JSON file ${JSON.stringify(file)}: ${errorMessage(exc)}`);
+  }
+}
+function dumpJson(payload) {
+  return JSON.stringify(payload, (_key, value) => isObject(value) ? Object.fromEntries(Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) : value);
+}
+function writePrivateJson(file, payload) {
+  const directory = path.dirname(file);
+  fs.mkdirSync(directory, { recursive: true, mode: 448 });
+  const temporary = path.join(directory, `.ce-forgejo-${randomUUID().slice(0, 8)}`);
+  const fd = fs.openSync(temporary, "wx", 384);
+  try {
+    try {
+      fs.fchmodSync(fd, 384);
+      fs.writeSync(fd, `${dumpJson(payload)}
+`);
+      fs.fsyncSync(fd);
+    } finally {
+      fs.closeSync(fd);
+    }
+    fs.renameSync(temporary, file);
+  } finally {
+    fs.rmSync(temporary, { force: true });
+  }
+}
+
+// src/url.ts
+function sameAuthority(a, b) {
+  return a[0] === b[0] && a[1] === b[1];
+}
+var SCHEME_RE = /^[a-z][a-z\d+.-]*:\/\//iu;
+function parseHttpUrl(value) {
+  const raw = value.trim();
+  if (!raw)
+    throw new CeError("empty URL or host");
+  let url;
+  try {
+    url = new URL(SCHEME_RE.test(raw) ? raw : `https://${raw}`);
+  } catch {
+    throw new CeError(`invalid URL or host ${JSON.stringify(value)}`);
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new CeError(`unsupported URL scheme ${JSON.stringify(url.protocol.slice(0, -1))}`);
+  }
+  if (!url.hostname)
+    throw new CeError(`missing hostname in ${JSON.stringify(value)}`);
+  return url;
+}
+function urlAuthority(value) {
+  const url = parseHttpUrl(value);
+  const port = url.port ? Number(url.port) : url.protocol === "http:" ? 80 : 443;
+  return [url.hostname.replace(/^\[(.*)\]$/u, "$1"), port];
+}
+function assertAbsoluteHttpUrl(value, error) {
+  try {
+    if (!SCHEME_RE.test(value.trim()))
+      throw new CeError(error);
+    parseHttpUrl(value);
+  } catch {
+    throw new CeError(error);
+  }
+}
+function registryServer(value) {
+  const url = parseHttpUrl(value);
+  const authority = value.trim().replace(SCHEME_RE, "").split(/[/\\?#]/u, 1)[0].split("@").at(-1);
+  const port = url.port || /:(\d+)$/u.exec(authority)?.[1];
+  return port ? `${url.hostname}:${Number(port)}` : url.hostname;
+}
+function registryKey(value) {
+  return registryServer(value).toLowerCase();
+}
+
+// src/metadata.ts
+var CI_VARIABLES = [
+  "image",
+  "ref",
+  "branch",
+  "pr",
+  "tag",
+  "default",
+  "revision",
+  "sha",
+  "version",
+  "major",
+  "minor",
+  "patch",
+  "stable"
+];
+var ENV_VARIABLE = /^env\.([A-Za-z_][A-Za-z0-9_]*)$/u;
+var SEMVER = /^v?((0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?)$/u;
+var nonEmpty = (value) => value ? value : undefined;
+
+class CiMetadata {
+  #env;
+  #cache = new Map;
+  #ref;
+  #event;
+  constructor(env = process.env) {
+    this.#env = env;
+  }
+  known(name) {
+    return CI_VARIABLES.includes(name) || ENV_VARIABLE.test(name);
+  }
+  get(name) {
+    const envName = ENV_VARIABLE.exec(name)?.[1];
+    if (envName)
+      return nonEmpty(this.#env[envName]);
+    if (!this.#cache.has(name))
+      this.#cache.set(name, this.#resolve(name));
+    return this.#cache.get(name);
+  }
+  labels() {
+    const labels = {};
+    const add = (key, value) => {
+      try {
+        const v = value();
+        if (v)
+          labels[`org.opencontainers.image.${key}`] = v;
+      } catch (exc) {
+        if (!(exc instanceof CeError))
+          throw exc;
+      }
+    };
+    const server = nonEmpty(this.#ciEnv("SERVER_URL"))?.replace(/\/+$/u, "");
+    const repository = nonEmpty(this.#ciEnv("REPOSITORY"));
+    add("source", () => server && repository ? `${server}/${repository}` : undefined);
+    add("revision", () => this.#ciEnv("SHA"));
+    add("version", () => this.get("version") ?? this.#rawRef());
+    add("title", () => repository?.split("/").at(-1));
+    add("description", () => {
+      const repo = this.#payload().repository;
+      return isObject(repo) && typeof repo.description === "string" ? repo.description : undefined;
+    });
+    return labels;
+  }
+  #resolve(name) {
+    switch (name) {
+      case "image": {
+        const server = this.#require("SERVER_URL", "{image}");
+        const repository = this.#require("REPOSITORY", "{image}");
+        return `${registryServer(server)}/${repository}`.toLowerCase();
+      }
+      case "ref":
+        return this.#rawRef();
+      case "branch": {
+        const ref = this.#parsedRef();
+        return ref.kind === "branch" ? ref.name : undefined;
+      }
+      case "tag": {
+        const ref = this.#parsedRef();
+        return ref.kind === "tag" ? ref.name : undefined;
+      }
+      case "pr": {
+        const ref = this.#parsedRef();
+        return ref.kind === "pr" ? ref.number : undefined;
+      }
+      case "default": {
+        const ref = this.#parsedRef();
+        if (ref.kind !== "branch")
+          return;
+        return ref.name === this.#defaultBranch() ? ref.name : undefined;
+      }
+      case "revision":
+        return this.#require("SHA", `{${name}}`);
+      case "sha":
+        return this.#require("SHA", `{${name}}`).slice(0, 7);
+      case "version":
+        return this.#semver()?.[1];
+      case "major":
+        return this.#semver()?.[2];
+      case "minor":
+        return this.#semver()?.[3];
+      case "patch":
+        return this.#semver()?.[4];
+      case "stable": {
+        const semver = this.#semver();
+        return semver && semver[5] === undefined ? semver[1] : undefined;
+      }
+    }
+    throw new CeError(`ce: unknown placeholder {${name}}`);
+  }
+  #ciEnv(name) {
+    return nonEmpty(this.#env[`FORGEJO_${name}`]) ?? nonEmpty(this.#env[`GITHUB_${name}`]);
+  }
+  #require(name, user) {
+    const value = this.#ciEnv(name);
+    if (!value) {
+      throw new CeError(`ce: ${user} needs GITHUB_${name} (or FORGEJO_${name}), which is not set; is this a Forgejo Actions run?`);
+    }
+    return value;
+  }
+  #rawRef() {
+    const ref = this.#parsedRef();
+    return ref.kind === "pr" ? `pr-${ref.number}` : ref.name;
+  }
+  #parsedRef() {
+    if (this.#ref)
+      return this.#ref;
+    const ref = this.#require("REF", "{ref}, {branch}, {tag} or {pr}");
+    const event = this.#ciEnv("EVENT_NAME") ?? "";
+    const pull = /^refs\/pull\/(\d+)\//u.exec(ref);
+    if (event.startsWith("pull_request") || pull) {
+      const payload = pull ? {} : this.#payload();
+      const fromPayload = [isObject(payload.pull_request) && payload.pull_request.number, payload.number].find(Number.isInteger);
+      const number = pull?.[1] ?? (fromPayload === undefined ? undefined : String(fromPayload));
+      if (!number)
+        throw new CeError(`ce: cannot find the pull request number for ${event} on ${ref}`);
+      this.#ref = { kind: "pr", number };
+    } else if (ref.startsWith("refs/heads/")) {
+      this.#ref = { kind: "branch", name: ref.slice("refs/heads/".length) };
+    } else if (ref.startsWith("refs/tags/")) {
+      this.#ref = { kind: "tag", name: ref.slice("refs/tags/".length) };
+    } else {
+      throw new CeError(`ce: cannot tell what ${JSON.stringify(ref)} is: not a branch, tag or pull request`);
+    }
+    return this.#ref;
+  }
+  #semver() {
+    const ref = this.#parsedRef();
+    return ref.kind === "tag" ? SEMVER.exec(ref.name) : null;
+  }
+  #defaultBranch() {
+    const repository = this.#payload().repository;
+    const branch = isObject(repository) ? repository.default_branch : undefined;
+    if (typeof branch !== "string" || !branch) {
+      throw new CeError("ce: {default} needs repository.default_branch in the event file, which it does not have");
+    }
+    return branch;
+  }
+  #payload() {
+    if (this.#event)
+      return this.#event;
+    const file = this.#require("EVENT_PATH", "reading the event file");
+    let payload;
+    try {
+      payload = readJsonFile(file, undefined);
+    } catch (exc) {
+      throw new CeError(`ce: ${errorMessage(exc)}`);
+    }
+    if (!isObject(payload))
+      throw new CeError(`ce: the event file ${JSON.stringify(file)} is missing or not a JSON object`);
+    this.#event = payload;
+    return payload;
+  }
+}
+
+// src/system.ts
+import { spawnSync } from "node:child_process";
+import fs2 from "node:fs";
+import path2 from "node:path";
+import { setTimeout } from "node:timers/promises";
+var io = {
+  stdout: (text) => void fs2.writeSync(1, text),
+  stderr: (text) => void fs2.writeSync(2, text),
+  stdin: () => fs2.readFileSync(0, "utf8"),
+  argv0: () => process.argv[1] ?? "ce"
+};
+function log(line) {
+  io.stdout(`${line}
+`);
+}
+function logError(line) {
+  io.stderr(`${line}
+`);
+}
+function childEnv() {
+  return Object.fromEntries(Object.entries(process.env).filter((entry) => entry[1] !== undefined));
+}
+function which(command) {
+  const candidates = command.includes("/") ? [command] : (process.env.PATH ?? "").split(path2.delimiter).filter(Boolean).map((dir) => path2.join(dir, command));
+  for (const candidate of candidates) {
+    try {
+      fs2.accessSync(candidate, fs2.constants.X_OK);
+      if (fs2.statSync(candidate).isFile())
+        return candidate;
+    } catch {}
+  }
+  return null;
+}
+var system = {
+  which,
+  run(argv, input) {
+    const result = spawnSync(argv[0], argv.slice(1), {
+      input,
+      stdio: [input === undefined ? "ignore" : "pipe", "ignore", "pipe"],
+      env: childEnv(),
+      encoding: "utf8",
+      maxBuffer: Infinity
+    });
+    if (result.error)
+      throw result.error;
+    return { status: result.status ?? 1, stderr: result.stderr ?? "" };
+  },
+  sleep: (ms) => setTimeout(ms),
+  exec(file, argv) {
+    const resolved = system.which(file);
+    if (!resolved) {
+      logError(`ce: ${file} not found on PATH`);
+      return 1;
+    }
+    process.execve(resolved, argv, childEnv());
+    throw new Error(`execve returned for ${file}`);
+  }
+};
+function binDir() {
+  return fs2.realpathSync(path2.join(import.meta.dirname, "..", "bin"));
+}
+function ensureHelperOnPath() {
+  const dir = binDir();
+  const parts = (process.env.PATH ?? "").split(path2.delimiter);
+  if (!parts.includes(dir))
+    process.env.PATH = [dir, ...parts].join(path2.delimiter);
+}
+
+// src/template.ts
+var PLACEHOLDER = /\{([^{}]*)\}/gu;
+function hasPlaceholders(value) {
+  return value.includes("{") || value.includes("}");
+}
+function parse(template, vars) {
+  const parts = [];
+  const text = (value) => {
+    if (hasPlaceholders(value))
+      throw new CeError(`ce: unmatched brace in ${JSON.stringify(template)}`);
+    if (value)
+      parts.push({ text: value });
+  };
+  let last = 0;
+  for (const match of template.matchAll(PLACEHOLDER)) {
+    text(template.slice(last, match.index));
+    last = match.index + match[0].length;
+    const guard = match[1].startsWith("?");
+    const name = guard ? match[1].slice(1) : match[1];
+    if (!vars.known(name))
+      throw new CeError(`ce: unknown placeholder ${match[0]} in ${JSON.stringify(template)}`);
+    parts.push({ name, guard });
+  }
+  text(template.slice(last));
+  return parts;
+}
+function expand(template, vars, encode) {
+  const parts = parse(template, vars);
+  for (const part of parts) {
+    if ("name" in part && part.guard && vars.get(part.name) === undefined)
+      return null;
+  }
+  let out = "";
+  for (const part of parts) {
+    if ("text" in part)
+      out += part.text;
+    else if (!part.guard) {
+      const value = vars.get(part.name);
+      if (value === undefined) {
+        throw new CeError(`ce: {${part.name}} has no value here, in ${JSON.stringify(template)}. ` + `To leave the tag out instead, guard it with {?${part.name}}.`);
+      }
+      out += encode(value);
+    }
+  }
+  return out;
+}
+function checkValue(template, vars, what) {
+  if (parse(template, vars).some((part) => ("guard" in part) && part.guard)) {
+    throw new CeError(`ce: ${what} ${JSON.stringify(template)} cannot use {?guards}; they only apply to tags`);
+  }
+}
+function expandValue(template, vars, encode, what) {
+  checkValue(template, vars, what);
+  return expand(template, vars, encode);
+}
+
+// src/tags.ts
+var INVALID_TAG_CHARS = /[^A-Za-z0-9_.\-]/gu;
+var INVALID_SCOPE_CHARS = /[^A-Za-z0-9_.:/\-]/gu;
+var VALID_TAG = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/u;
+var HOST_PORT = /^([^/:]+):(?:\d|\{[^{}]*\})+\//u;
+var SEPARATORS = "-_.";
+function sanitizeChars(value, charRegex) {
+  return value.replace(charRegex, "_");
+}
+function assertAscii(label, value) {
+  for (const ch of value) {
+    const code = ch.codePointAt(0);
+    if (code >= 128) {
+      const hex = code.toString(16).toUpperCase().padStart(4, "0");
+      throw new CeError(`ce: refusing to sanitize non-ASCII character ${JSON.stringify(ch)} ` + `(U+${hex}) in ${label} ${JSON.stringify(value)} — rename the ref ` + `or pass an explicit ASCII tag.`);
+    }
+  }
+}
+function stripProto(value) {
+  return value.replace(/^https?:\/\//u, "");
+}
+function splitOnce(value, sep) {
+  const i = value.indexOf(sep);
+  return i < 0 ? [value, ""] : [value.slice(0, i), value.slice(i + sep.length)];
+}
+function splitRef(value) {
+  const host = HOST_PORT.exec(value);
+  const isHost = host && (host[1].includes(".") || host[1] === "localhost" || value.includes(":", host[0].length));
+  const offset = isHost ? host[0].length : 0;
+  const i = value.indexOf(":", offset);
+  return i < 0 ? null : [value.slice(0, i), value.slice(i + 1)];
+}
+function assertValidTag(repo, tag) {
+  if (!VALID_TAG.test(tag)) {
+    throw new CeError(`ce: invalid tag ${JSON.stringify(tag)} in ${JSON.stringify(`${repo}:${tag}`)}: a tag is up to 128 letters, ` + `digits, "_", "." and "-", and cannot start with "." or "-".`);
+  }
+  return `${repo}:${tag}`;
+}
+function encodeTagValue(value) {
+  assertAscii("placeholder value", value);
+  return value.replace(INVALID_TAG_CHARS, "-");
+}
+function encodeRepoValue(value) {
+  assertAscii("placeholder value", value);
+  if (/[^A-Za-z0-9._:/-]/u.test(value))
+    throw new CeError(`ce: ${JSON.stringify(value)} cannot go in an image name`);
+  return value;
+}
+function expandImage(template, vars) {
+  const image = expandValue(template, vars, encodeRepoValue, "image name");
+  if (!/^(?:[^/:]+:\d+\/)?[^:]*$/u.test(image)) {
+    throw new CeError(`ce: image name ${JSON.stringify(image)} from ${JSON.stringify(template)} has a ":" that is not a registry port`);
+  }
+  return image;
+}
+function expandPrefix(prefix, vars, what) {
+  return hasPlaceholders(prefix) ? expandValue(prefix, vars, encodeTagValue, what) : prefix;
+}
+function literalRef(repo, tag) {
+  if (tag.includes("/")) {
+    const [first, rest] = splitOnce(tag, "/");
+    return `${repo}/${sanitizeChars(first, INVALID_TAG_CHARS)}:${sanitizeChars(rest, INVALID_TAG_CHARS)}`;
+  }
+  return `${repo}:${sanitizeChars(tag, INVALID_TAG_CHARS)}`;
+}
+function computeSafePrefix(prefix) {
+  assertAscii("tag prefix", prefix);
+  const p = sanitizeChars(prefix, INVALID_TAG_CHARS);
+  return p && !SEPARATORS.includes(p.at(-1)) ? `${p}-` : p;
+}
+function rewriteTagValue(value, tagPrefix, vars = new CiMetadata) {
+  assertAscii("tag", value);
+  const v = stripProto(value);
+  if (!v)
+    throw new CeError("ce: empty -t/--tag value");
+  const [repoTemplate, tagList] = splitRef(v) ?? [v, undefined];
+  if (hasPlaceholders(repoTemplate))
+    checkValue(repoTemplate, vars, "image name");
+  if (hasPlaceholders(tagPrefix))
+    checkValue(tagPrefix, vars, "tag prefix");
+  let repo;
+  const expandRepo = () => repo ??= hasPlaceholders(repoTemplate) ? expandImage(repoTemplate, vars) : repoTemplate;
+  if (tagList === undefined)
+    return [expandRepo()];
+  const tags = tagList.split(/[,\s]+/u).filter(Boolean);
+  if (!tags.length)
+    throw new CeError(`ce: no tag after the ":" in ${JSON.stringify(value)}`);
+  let safePrefix;
+  const refs = [];
+  for (const tag of tags) {
+    const expanded = hasPlaceholders(tag) ? expand(tag, vars, encodeTagValue) : tag;
+    if (expanded === null)
+      continue;
+    safePrefix ??= computeSafePrefix(expandPrefix(tagPrefix, vars, "tag prefix"));
+    if (hasPlaceholders(tag)) {
+      refs.push(assertValidTag(expandRepo(), `${safePrefix}${sanitizeChars(expanded, INVALID_TAG_CHARS)}`));
+    } else {
+      const ref = literalRef(expandRepo(), `${safePrefix}${tag}`);
+      const i = ref.lastIndexOf(":");
+      refs.push(assertValidTag(ref.slice(0, i), ref.slice(i + 1)));
+    }
+  }
+  return refs;
+}
+function csvFields(value) {
+  value = value.replace(/\r?\n$/u, "");
+  if (!value)
+    return null;
+  const fields = [];
+  let i = 0;
+  for (;; ) {
+    if (value[i] !== '"') {
+      const end = value.indexOf(",", i);
+      const field = end < 0 ? value.slice(i) : value.slice(i, end);
+      if (field.includes('"'))
+        return null;
+      fields.push(field);
+      if (end < 0)
+        return fields;
+      i = end + 1;
+      continue;
+    }
+    let field = "";
+    for (i++;; i++) {
+      const quote = value.indexOf('"', i);
+      if (quote < 0)
+        return null;
+      field += value.slice(i, quote);
+      i = quote + 1;
+      if (value[i] !== '"')
+        break;
+      field += '"';
+    }
+    fields.push(field);
+    if (i === value.length)
+      return fields;
+    if (value[i] !== ",")
+      return null;
+    i++;
+  }
+}
+function csvJoin(fields) {
+  return fields.map((field) => /^[ \t]|[",\r\n]/u.test(field) ? `"${field.replaceAll('"', '""')}"` : field).join(",");
+}
+var fieldKey = (field) => field.split("=", 1)[0].toLowerCase();
+function ghaFields(value) {
+  const fields = csvFields(value);
+  const type = fields?.findLast((field) => fieldKey(field) === "type");
+  return type?.slice("type=".length) === "gha" ? fields : null;
+}
+var scopeIndex = (fields) => fields.findLastIndex((field) => fieldKey(field) === "scope");
+function cacheScopeName(value) {
+  const fields = ghaFields(value);
+  if (!fields)
+    return value;
+  const i = scopeIndex(fields);
+  if (i < 0)
+    return "";
+  const scope = fields[i].slice("scope=".length);
+  assertAscii("cache scope", scope);
+  return sanitizeChars(scope, INVALID_SCOPE_CHARS);
+}
+function normalizeCacheScope(value, cachePrefix) {
+  const fields = ghaFields(value);
+  if (!fields)
+    return value;
+  if (!cachePrefix)
+    return value;
+  assertAscii("cache prefix", cachePrefix);
+  const prefix = sanitizeChars(cachePrefix, INVALID_TAG_CHARS);
+  let scope = cacheScopeName(value);
+  if (!scope) {
+    scope = prefix.replace(/[-_.]+$/u, "");
+  } else if (prefix) {
+    scope = SEPARATORS.includes(prefix.at(-1)) ? `${prefix}${scope}` : `${prefix}-${scope}`;
+  }
+  const i = scopeIndex(fields);
+  if (i < 0)
+    fields.push(`scope=${scope}`);
+  else
+    fields[i] = `scope=${scope}`;
+  return csvJoin(fields);
+}
+
+// src/build-args.ts
+function consumeValue(argv, flag) {
+  if (argv.length === 0)
+    throw new CeError(`ce: ${flag} requires a value but none was provided.`);
+  const v = argv[0];
+  if (v.length > 1 && v.startsWith("-")) {
+    throw new CeError(`ce: ${flag} requires a value but the next token ${JSON.stringify(v)} looks like a flag.`);
+  }
+  return [v, argv.slice(1)];
+}
+var SUMMARIZED = {
+  "-f": "dockerfile",
+  "--file": "dockerfile",
+  "--target": "target",
+  "--platform": "platform",
+  "--build-arg": "buildArgs",
+  "--label": "labels"
+};
+function parseBuildArgs(argv, tagPrefix, cachePrefix, { vars = new CiMetadata, labels = {} } = {}) {
+  const args = [];
+  const rawCacheFrom = [];
+  const rawCacheTo = [];
+  const summary = {
+    tags: [],
+    cacheFrom: [],
+    cacheTo: [],
+    buildArgs: [],
+    labels: [],
+    dockerfile: "",
+    target: "",
+    platform: "",
+    context: ""
+  };
+  let templated = false;
+  let rest = [];
+  const addTags = (value, flag) => {
+    templated ||= hasPlaceholders(value);
+    const refs = rewriteTagValue(value, tagPrefix, vars);
+    for (const ref of refs)
+      args.push(`${flag}${ref}`);
+    summary.tags.push(...refs);
+  };
+  const summarize = (flag, value) => {
+    const field = SUMMARIZED[flag];
+    if (field === "buildArgs" || field === "labels")
+      summary[field].push(value);
+    else
+      summary[field] = value;
+  };
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i];
+    const [name, attached] = arg.startsWith("--") && arg.includes("=") ? splitAt(arg, "=") : [arg, undefined];
+    const next = () => consumeValue(argv.slice(++i), arg)[0];
+    if (arg === "--") {
+      rest = argv.slice(i);
+      if (rest.length > 1)
+        summary.context = rest.at(-1);
+      break;
+    } else if (arg === "-t")
+      addTags(next(), "-t");
+    else if (arg === "--tag")
+      addTags(next(), "--tag=");
+    else if (arg.startsWith("-t"))
+      addTags(arg.slice(2), "-t");
+    else if (name === "--tag")
+      addTags(attached, "--tag=");
+    else if (name === "--cache-from")
+      rawCacheFrom.push(attached ?? next());
+    else if (name === "--cache-to")
+      rawCacheTo.push(attached ?? next());
+    else if (name === "--cache") {
+      const v = attached ?? next();
+      rawCacheFrom.push(v);
+      rawCacheTo.push(v);
+    } else if (Object.hasOwn(SUMMARIZED, name)) {
+      const flag = name;
+      if (attached === undefined) {
+        const v = next();
+        args.push(arg, v);
+        summarize(flag, v);
+      } else {
+        args.push(arg);
+        summarize(flag, attached);
+      }
+    } else if (arg.startsWith("-f") && arg.length > 2) {
+      args.push(arg);
+      summary.dockerfile = arg.slice(2);
+    } else {
+      args.push(arg);
+      if (!arg.startsWith("-"))
+        summary.context = arg;
+    }
+  }
+  if (templated && !summary.tags.length) {
+    throw new CeError("ce: the guards in the -t templates left out every tag, so the image would have none");
+  }
+  const ownKeys = new Set(summary.labels.map((label) => label.split("=", 1)[0]));
+  const added = Object.entries(labels).filter(([key]) => !ownKeys.has(key)).map(([key, value]) => `${key}=${value}`);
+  args.unshift(...added.map((label) => `--label=${label}`));
+  summary.labels.unshift(...added);
+  if (rawCacheFrom.length || rawCacheTo.length)
+    cachePrefix = expandPrefix(cachePrefix, vars, "cache prefix");
+  const toNames = new Set(rawCacheTo.map(cacheScopeName));
+  for (const c of rawCacheFrom) {
+    const rewritten = toNames.has(cacheScopeName(c)) ? normalizeCacheScope(c, cachePrefix) : c;
+    args.push(`--cache-from=${rewritten}`);
+    summary.cacheFrom.push(rewritten);
+  }
+  for (const c of rawCacheTo) {
+    const rewritten = normalizeCacheScope(c, cachePrefix);
+    args.push(`--cache-to=${rewritten}`);
+    summary.cacheTo.push(rewritten);
+  }
+  args.push(...rest);
+  return { args, summary };
+}
+function splitAt(value, sep) {
+  const i = value.indexOf(sep);
+  return [value.slice(0, i), value.slice(i + 1)];
+}
+function printBuildSummary(engine, args, summary) {
+  const command = findBuildCommand(engine, args);
+  if (!command || command.tagsOnly)
+    return;
+  const subcommand = command.name;
+  const out = ["[ce] build summary:", `  engine: ${engine}`, `  subcommand: ${subcommand}`];
+  const list = (title, items) => {
+    if (items.length)
+      out.push(`  ${title}:`, ...items.map((item) => `    - ${item}`));
+  };
+  list("tags", summary.tags);
+  list("cache-from", summary.cacheFrom);
+  list("cache-to", summary.cacheTo);
+  if (summary.dockerfile)
+    out.push(`  dockerfile: ${summary.dockerfile}`);
+  if (summary.target)
+    out.push(`  target: ${summary.target}`);
+  if (summary.platform)
+    out.push(`  platform: ${summary.platform}`);
+  list("build args", summary.buildArgs);
+  list("labels", summary.labels);
+  if (summary.context)
+    out.push(`  context: ${summary.context}`);
+  io.stderr(`${out.join(`
+`)}
+
+`);
+}
+
+// src/oidc.ts
+var REFRESH_WINDOW_S = 5 * 60;
+var REQUEST_TIMEOUT_MS = 30000;
+var decodeUtf8 = (bytes) => new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+async function forgejoOidcJwt(audience, requestUrl, requestToken) {
+  assertAbsoluteHttpUrl(requestUrl, "token request URL must be an absolute HTTP(S) URL");
+  let tokenUrl;
+  let headers;
+  try {
+    const url = new URL(requestUrl);
+    if (url.username || url.password)
+      throw new Error("credentials in URL");
+    url.searchParams.set("audience", audience);
+    tokenUrl = url.href;
+    headers = { Accept: "application/json", Authorization: `bearer ${requestToken}` };
+    new Headers(headers);
+  } catch {
+    throw new CeError("token request URL or headers are invalid");
+  }
+  let body;
+  try {
+    const response = await fetch(tokenUrl, { headers, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+    if (!response.ok)
+      throw new Error(`HTTP ${response.status} ${response.statusText}`);
+    body = await response.arrayBuffer();
+  } catch (exc) {
+    throw new CeError(`token request failed: ${errorMessage(exc)}`);
+  }
+  let payload;
+  try {
+    payload = JSON.parse(decodeUtf8(body));
+  } catch {
+    throw new CeError("token response is not valid UTF-8 JSON");
+  }
+  if (!isObject(payload))
+    throw new CeError("token response is not a JSON object");
+  const jwt = payload.value;
+  if (typeof jwt !== "string" || !jwt.trim()) {
+    throw new CeError("token response has no non-empty string 'value'");
+  }
+  return jwt.trim();
+}
+function jwtExpiry(jwt) {
+  const parts = jwt.split(".");
+  if (parts.length !== 3)
+    throw new CeError("OIDC token is not a three-part JWT");
+  let payload;
+  try {
+    payload = JSON.parse(decodeUtf8(Buffer.from(parts[1], "base64url")));
+  } catch {
+    throw new CeError("OIDC token has an invalid JWT payload");
+  }
+  const expiry = isObject(payload) ? payload.exp : undefined;
+  if (typeof expiry !== "number")
+    throw new CeError("OIDC token has no numeric 'exp' claim");
+  return expiry;
+}
+function needsRefresh(expiry) {
+  return expiry <= Date.now() / 1000 + REFRESH_WINDOW_S;
+}
+
+// src/state.ts
+import fs4 from "node:fs";
+import { homedir } from "node:os";
+import path3 from "node:path";
+
+// src/lock.ts
+import fs3 from "node:fs";
+import { hostname } from "node:os";
+import { setTimeout as setTimeout2 } from "node:timers/promises";
+var STALE_AFTER_MS = 120000;
+var POLL_MS = 50;
+function snapshot(lockPath) {
+  try {
+    const { ino, mtimeMs } = fs3.statSync(lockPath);
+    return { ino, mtimeMs, owner: fs3.readFileSync(lockPath, "utf8").trim() };
+  } catch (exc) {
+    if (isErrno(exc, "ENOENT"))
+      return null;
+    throw exc;
+  }
+}
+function isStale({ mtimeMs, owner }) {
+  if (Date.now() - mtimeMs > STALE_AFTER_MS)
+    return true;
+  const match = /^(\d+)@(.*)$/u.exec(owner);
+  if (!match || match[2] !== hostname())
+    return false;
+  try {
+    process.kill(Number(match[1]), 0);
+    return false;
+  } catch (exc) {
+    return !isErrno(exc, "EPERM");
+  }
+}
+function breakIfStale(lockPath) {
+  const stale = snapshot(lockPath);
+  if (!stale || !isStale(stale))
+    return;
+  const guard = `${lockPath}.break`;
+  try {
+    fs3.writeFileSync(guard, "", { flag: "wx", mode: 384 });
+  } catch (exc) {
+    if (!isErrno(exc, "EEXIST"))
+      throw exc;
+    const held = snapshot(guard);
+    if (held && Date.now() - held.mtimeMs > STALE_AFTER_MS) {
+      throw new CeError(`stale lock guard ${JSON.stringify(guard)}: remove it if no ce is running`);
+    }
+    return;
+  }
+  try {
+    const current = snapshot(lockPath);
+    if (current && current.ino === stale.ino && current.mtimeMs === stale.mtimeMs && current.owner === stale.owner) {
+      fs3.rmSync(lockPath, { force: true });
+    }
+  } finally {
+    fs3.rmSync(guard, { force: true });
+  }
+}
+async function withFileLock(lockPath, fn) {
+  const owner = `${process.pid}@${hostname()}`;
+  let ino;
+  for (;; ) {
+    let fd;
+    try {
+      fd = fs3.openSync(lockPath, "wx", 384);
+    } catch (exc) {
+      if (!isErrno(exc, "EEXIST"))
+        throw exc;
+      breakIfStale(lockPath);
+      await setTimeout2(POLL_MS);
+      continue;
+    }
+    try {
+      fs3.writeSync(fd, `${owner}
+`);
+      ino = fs3.fstatSync(fd).ino;
+    } finally {
+      fs3.closeSync(fd);
+    }
+    break;
+  }
+  try {
+    return await fn();
+  } finally {
+    const current = snapshot(lockPath);
+    if (current?.ino === ino && current.owner === owner)
+      fs3.rmSync(lockPath, { force: true });
+  }
+}
+
+// src/state.ts
+var HELPER_SUFFIX = "ce-forgejo";
+var STATE_FILE = "ce-forgejo-credentials.json";
+function dockerConfigDir() {
+  const configured = process.env.DOCKER_CONFIG;
+  if (!configured)
+    return path3.join(homedir(), ".docker");
+  const expanded = configured === "~" || configured.startsWith("~/") ? path3.join(homedir(), configured.slice(1)) : configured;
+  return path3.resolve(expanded);
+}
+function helperStatePath() {
+  return path3.join(dockerConfigDir(), STATE_FILE);
+}
+async function withHelperState(fn) {
+  const statePath = helperStatePath();
+  fs4.mkdirSync(path3.dirname(statePath), { recursive: true, mode: 448 });
+  return withFileLock(`${statePath}.pidlock`, async () => {
+    const state = readJsonFile(statePath, { version: 1, registries: {} });
+    if (!isObject(state) || !isObject(state.registries)) {
+      throw new CeError("Forgejo credential-helper state is invalid");
+    }
+    const before = JSON.stringify(state);
+    const result = await fn(state);
+    if (JSON.stringify(state) !== before)
+      writePrivateJson(statePath, state);
+    return result;
+  });
+}
+async function saveHelperState(registry, username, audience, authority, jwt) {
+  const expiry = jwtExpiry(jwt);
+  if (needsRefresh(expiry))
+    throw new CeError("OIDC token expires within the five-minute refresh window");
+  await withHelperState((state) => {
+    state.registries[registryKey(registry)] = {
+      audience,
+      authority: [authority[0], authority[1]],
+      expires_at: expiry,
+      token: jwt,
+      username
+    };
+  });
+}
+async function configureDockerCredentialHelper(registry, username, audience, authority, jwt) {
+  await saveHelperState(registry, username, audience, authority, jwt);
+  const configPath = path3.join(dockerConfigDir(), "config.json");
+  const config = readJsonFile(configPath, {});
+  if (!isObject(config))
+    throw new CeError("Docker config is not a JSON object");
+  config.credHelpers ??= {};
+  const helpers = config.credHelpers;
+  if (!isObject(helpers))
+    throw new CeError("Docker config 'credHelpers' is not a JSON object");
+  helpers[registry] = HELPER_SUFFIX;
+  const auths = config.auths;
+  if (isObject(auths)) {
+    for (const key of Object.keys(auths)) {
+      if (registryKey(key) === registryKey(registry))
+        delete auths[key];
+    }
+  }
+  writePrivateJson(configPath, config);
+}
+
+// src/credential-helper.ts
+async function helperGet(registry) {
+  const key = registryKey(registry);
+  return withHelperState(async (state) => {
+    const entry = state.registries[key];
+    if (!isObject(entry)) {
+      throw new CeError(`no Forgejo OIDC credentials configured for ${JSON.stringify(registry)}`);
+    }
+    const { username, token, expires_at: expiry } = entry;
+    if (typeof username !== "string" || !username) {
+      throw new CeError("Forgejo credential-helper username is missing");
+    }
+    if (typeof token !== "string" || typeof expiry !== "number") {
+      throw new CeError("Forgejo credential-helper token state is invalid");
+    }
+    if (!needsRefresh(expiry))
+      return { Username: username, Secret: token };
+    const { audience, authority } = entry;
+    const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL ?? "";
+    const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN ?? "";
+    if (typeof audience !== "string" || !audience) {
+      throw new CeError("Forgejo credential-helper audience is missing");
+    }
+    if (!(requestUrl && requestToken)) {
+      throw new CeError("OIDC refresh requires ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN");
+    }
+    const [host, port] = urlAuthority(requestUrl);
+    if (!Array.isArray(authority) || authority.length !== 2 || authority[0] !== host || authority[1] !== port) {
+      throw new CeError("OIDC token-request host does not match the registry");
+    }
+    const refreshed = await forgejoOidcJwt(audience, requestUrl, requestToken);
+    const refreshedExpiry = jwtExpiry(refreshed);
+    if (needsRefresh(refreshedExpiry)) {
+      throw new CeError("refreshed OIDC token expires within the five-minute window");
+    }
+    entry.token = refreshed;
+    entry.expires_at = refreshedExpiry;
+    return { Username: username, Secret: refreshed };
+  });
+}
+async function helperStore(input) {
+  const payload = JSON.parse(input);
+  if (!isObject(payload))
+    throw new CeError("credential-helper store payload is invalid");
+  const { ServerURL: registry, Username: username, Secret: secret } = payload;
+  const filled = (value) => typeof value === "string" && value !== "";
+  if (!(filled(registry) && filled(username) && filled(secret))) {
+    throw new CeError("credential-helper store fields are incomplete");
+  }
+  const expiry = jwtExpiry(secret);
+  await withHelperState((state) => {
+    const entry = state.registries[registryKey(registry)] ??= {};
+    Object.assign(entry, { expires_at: expiry, token: secret, username });
+  });
+}
+async function credentialHelper(argv) {
+  const [command] = argv;
+  if (argv.length !== 1 || !["get", "store", "erase", "list"].includes(command)) {
+    logError("ce: credential-helper requires get|store|erase|list");
+    return 1;
+  }
+  try {
+    if (command === "get") {
+      io.stdout(`${JSON.stringify(await helperGet(io.stdin().trim()))}
+`);
+    } else if (command === "store") {
+      await helperStore(io.stdin());
+    } else if (command === "erase") {
+      const key = registryKey(io.stdin().trim());
+      await withHelperState((state) => void delete state.registries[key]);
+    } else {
+      const entries = await withHelperState((state) => Object.fromEntries(Object.entries(state.registries).filter(([, entry]) => isObject(entry)).map(([key, entry]) => [key, entry.username ?? ""])));
+      io.stdout(`${JSON.stringify(entries)}
+`);
+    }
+    return 0;
+  } catch (exc) {
+    if (!(exc instanceof CeError || exc instanceof SyntaxError || isErrno(exc)))
+      throw exc;
+    logError(`ce: Forgejo credential helper: ${errorMessage(exc)}`);
+    return 1;
+  }
+}
+
+// src/engine.ts
+var isEngine = (value) => ["docker", "podman", "buildah"].includes(value);
+var WAIT_ATTEMPTS = 30;
+async function waitForEngine(engine) {
+  if (engine === "buildah")
+    return true;
+  for (let attempt = 1;attempt <= WAIT_ATTEMPTS; attempt++) {
+    if (system.run([engine, "info"]).status === 0)
+      return true;
+    logError(`waiting for ${engine}... (${attempt}/${WAIT_ATTEMPTS})`);
+    await system.sleep(1000);
+  }
+  logError(`no engine available: ${engine}`);
+  return false;
+}
+function envFlag(name) {
+  const value = (process.env[name] ?? "").toLowerCase();
+  if (["", "0", "false", "no"].includes(value))
+    return false;
+  if (["1", "true", "yes"].includes(value))
+    return true;
+  throw new CeError(`ce: ${name} must be true or false, not ${JSON.stringify(process.env[name])}`);
+}
+async function runEngine(engine, argv, tagPrefix, cachePrefix, ociLabels) {
+  const command = findBuildCommand(engine, argv);
+  let args = argv;
+  let summary;
+  if (command) {
+    const vars = new CiMetadata;
+    const labels = !command.tagsOnly && (ociLabels ?? envFlag("OCI_LABELS")) ? vars.labels() : {};
+    const parsed = parseBuildArgs(argv.slice(command.start), tagPrefix, cachePrefix, { vars, labels });
+    args = [...argv.slice(0, command.start), ...parsed.args];
+    summary = parsed.summary;
+  }
+  ensureHelperOnPath();
+  if (!system.which(engine)) {
+    logError(`Engine not found: ${engine}`);
+    return 1;
+  }
+  if (!await waitForEngine(engine))
+    return 1;
+  if (summary)
+    printBuildSummary(engine, args, summary);
+  if (engine === "docker")
+    return system.exec("docker", ["docker", ...args]);
+  if (system.which("gosu")) {
+    const user = process.env.USER ?? "";
+    if (!user) {
+      logError("ce: gosu is available but USER is not set; cannot drop privileges. Set USER or remove gosu from PATH.");
+      return 1;
+    }
+    return system.exec("gosu", ["gosu", user, engine, ...args]);
+  }
+  return system.exec(engine, [engine, ...args]);
+}
+
+// src/login.ts
+var ENGINES = ["docker", "podman", "buildah"];
+function registryGroups() {
+  const prefix = "REGISTRY_HOST__";
+  const suffixed = Object.keys(process.env).filter((name) => name.startsWith(prefix) && name.length > prefix.length).sort().map((name) => name.slice(prefix.length));
+  return [...process.env.REGISTRY_HOST ? [""] : [], ...suffixed];
+}
+function oidcConfig() {
+  const audience = process.env.AUD ?? "";
+  if (!audience)
+    return null;
+  const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL ?? "";
+  const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN ?? "";
+  if (!(requestUrl && requestToken)) {
+    return "Forgejo OIDC login config is incomplete: AUD requires ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN";
+  }
+  try {
+    assertAbsoluteHttpUrl(requestUrl, "must be an absolute HTTP(S) URL");
+    return { audience, requestUrl, requestToken, authority: urlAuthority(requestUrl) };
+  } catch (exc) {
+    if (!(exc instanceof CeError))
+      throw exc;
+    return `Invalid ACTIONS_ID_TOKEN_REQUEST_URL: ${exc.message}`;
+  }
+}
+function loginWithEngines(target, password) {
+  for (const engine of ENGINES) {
+    if (!system.which(engine))
+      continue;
+    let result;
+    try {
+      result = system.run([engine, "login", "-u", target.user, "--password-stdin", target.registry], `${password}
+`);
+    } catch (exc) {
+      if (isErrno(exc, "ENOENT"))
+        continue;
+      throw exc;
+    }
+    if (result.status === 0)
+      return engine;
+    logError(`${engine} login failed for '${target.label}' (${target.registry}):`);
+    io.stderr(result.stderr);
+  }
+  return null;
+}
+async function login() {
+  ensureHelperOnPath();
+  const groups = registryGroups();
+  if (groups.length === 0) {
+    log("Skipping login: no REGISTRY_HOST env vars set");
+    return 0;
+  }
+  const oidc = oidcConfig();
+  if (typeof oidc === "string") {
+    logError(oidc);
+    return 1;
+  }
+  const targets = [];
+  let failed = false;
+  for (const group of groups) {
+    const suffix = group ? `__${group}` : "";
+    const host = process.env[`REGISTRY_HOST${suffix}`] ?? "";
+    const user = process.env[`REGISTRY_USER${suffix}`] ?? "";
+    const password = process.env[`REGISTRY_PASSWORD${suffix}`] ?? "";
+    const label = group || "default";
+    const incomplete = `Login config for '${label}' is incomplete: host/user/password not all set`;
+    if (!(host && user)) {
+      logError(incomplete);
+      failed = true;
+      continue;
+    }
+    for (const rawRegistry of host.split(/\s+/u).filter(Boolean)) {
+      let authority;
+      let registry;
+      try {
+        authority = urlAuthority(rawRegistry);
+        registry = registryServer(rawRegistry);
+      } catch (exc) {
+        if (!(exc instanceof CeError))
+          throw exc;
+        logError(`Invalid registry host for '${label}' (${rawRegistry}): ${exc.message}`);
+        failed = true;
+        continue;
+      }
+      const useOidc = oidc !== null && sameAuthority(authority, oidc.authority);
+      if (!useOidc && !password) {
+        logError(incomplete);
+        failed = true;
+        continue;
+      }
+      targets.push({ registry, label, user, password, useOidc });
+    }
+  }
+  let jwt = null;
+  if (oidc && targets.some((target) => target.useOidc)) {
+    try {
+      jwt = await forgejoOidcJwt(oidc.audience, oidc.requestUrl, oidc.requestToken);
+    } catch (exc) {
+      if (!(exc instanceof CeError))
+        throw exc;
+      logError(`Failed to fetch Forgejo OIDC JWT: ${exc.message}`);
+      return 1;
+    }
+  }
+  for (const target of targets) {
+    const { registry, label } = target;
+    const password = target.useOidc ? jwt : target.password;
+    if (password === null) {
+      logError(`Forgejo OIDC JWT unavailable for '${label}' (${registry})`);
+      failed = true;
+      continue;
+    }
+    log(`Logging in to ${registry} (${label})...`);
+    const engine = loginWithEngines(target, password);
+    if (!engine) {
+      logError(`Login failed for '${label}' (${registry})`);
+      failed = true;
+      continue;
+    }
+    log(`Logged in to ${registry} (${label}) via ${engine} ` + `(and all engines at or below it: docker < podman < buildah share credentials)`);
+    if (target.useOidc && oidc && jwt) {
+      try {
+        await configureDockerCredentialHelper(registry, target.user, oidc.audience, oidc.authority, jwt);
+      } catch (exc) {
+        if (!(exc instanceof CeError || isErrno(exc)))
+          throw exc;
+        logError(`Failed to configure Forgejo credential helper for '${label}' (${registry}): ${errorMessage(exc)}`);
+        failed = true;
+      }
+    }
+  }
+  return failed ? 1 : 0;
+}
+
+// src/cli.ts
+function helpText() {
+  return `Usage: ${io.argv0()} [--tag-prefix=<prefix>] [--cache-prefix=<prefix>] [--oci-labels] [command|engine] [args]
+
+Options:
+    --tag-prefix=<prefix>
+                      Prepend <prefix> to every tag passed via -t/--tag.
+                      A trailing "-" is appended automatically if the prefix
+                      does not already end with "-", "_", or ".".
+                      Also available via TAG_PREFIX environment variable.
+    --cache-prefix=<prefix>
+                      Prepend <prefix> to the gha cache scopes in --cache-to,
+                      and in --cache-from where they match one; other
+                      --cache-from scopes stay shared. Defaults to the tag prefix
+                      (TAG_PREFIX); set to "" to keep cache scopes shared.
+                      Also available via CACHE_PREFIX environment variable.
+    --cache=<spec>    Shorthand for passing <spec> to both --cache-from and
+                      --cache-to. Supports the same forms as --cache-from/--cache-to.
+    --oci-labels      Add org.opencontainers.image.* labels (source, revision,
+                      version, title, description) from the Forgejo Actions
+                      run to builds. A --label with the same key wins.
+                      Also available via OCI_LABELS=true.
+
+Placeholders, in build tags and in the tag and cache prefixes:
+    {name}            The value of name; an error if it has none in this run.
+    {?name}           Expands to nothing; leaves the tag out unless name has
+                      a value. Not allowed in prefixes.
+    {image}           Registry host and repository, lowercased
+    {ref}             Branch name, pr-<number>, or tag name
+    {branch} {pr} {tag}
+                      Set only when building that kind of ref
+    {default}         Set only when building the default branch
+    {revision} {sha}  The commit, in full and as 7 characters
+    {version} {major} {minor} {patch}
+                      From a SemVer tag such as v1.2.3 (v optional)
+    {stable}          Set only for a SemVer tag without a pre-release
+    {env.NAME}        The environment variable NAME
+    Values are made safe for a tag ("ci/x" becomes "ci-x"). Quote templates
+    in single quotes. Example:
+        -t '{image}:{ref},{?default}latest'
+
+Commands:
+    login             Log in to all available engines
+
+Engines:
+    docker [args]     Passthrough to docker
+    podman [args]     Passthrough to podman (via gosu if available)
+    buildah [args]    Passthrough to buildah (via gosu if available)
+
+Environment variables (used by login):
+    Each registry is a "group". The default group uses the bare variables
+    below; additional registries use a __<name> suffix that ties the three
+    variables together.
+        REGISTRY_USER[__<name>]     username
+        REGISTRY_PASSWORD[__<name>] password
+        REGISTRY_HOST[__<name>]     registry host(s) (https:// stripped);
+                                   whitespace-separated list logs in to each
+                                   with the same creds, e.g. "docker.io dhi.io"
+        AUD                         Forgejo Authorized Integration audience.
+                                   When set, the registry matching the Forgejo
+                                   Actions token-request host uses a short-lived
+                                   OIDC JWT instead of REGISTRY_PASSWORD.
+                                   Docker uses a per-host credential helper that
+                                   refreshes the JWT five minutes before expiry.
+                                   Requires ACTIONS_ID_TOKEN_REQUEST_URL and
+                                   ACTIONS_ID_TOKEN_REQUEST_TOKEN from a job
+                                   with enable-openid-connect: true.
+    Defining REGISTRY_HOST__<name> adds a group; its creds come from
+    REGISTRY_USER__<name> and REGISTRY_PASSWORD__<name>. Example:
+    REGISTRY_HOST__DOCKER="docker.io dhi.io" + REGISTRY_USER__DOCKER +
+    REGISTRY_PASSWORD__DOCKER logs in to both Docker Hub and dhi.io with one
+    set of creds, alongside the default registry. The bare (unsuffixed)
+    variables are the default group — no suffix needed for the primary
+    registry.
+`;
+}
+async function main(argv) {
+  let ociLabels;
+  let tagPrefix = process.env.TAG_PREFIX ?? "";
+  let cachePrefix = process.env.CACHE_PREFIX ?? process.env.TAG_PREFIX ?? "";
+  for (;; ) {
+    const a = argv[0];
+    if (a === "--tag-prefix")
+      [tagPrefix, argv] = consumeValue(argv.slice(1), a);
+    else if (a?.startsWith("--tag-prefix="))
+      [tagPrefix, argv] = [a.slice("--tag-prefix=".length), argv.slice(1)];
+    else if (a === "--cache-prefix")
+      [cachePrefix, argv] = consumeValue(argv.slice(1), a);
+    else if (a?.startsWith("--cache-prefix="))
+      [cachePrefix, argv] = [a.slice("--cache-prefix=".length), argv.slice(1)];
+    else if (a === "--oci-labels")
+      [ociLabels, argv] = [true, argv.slice(1)];
+    else
+      break;
+  }
+  const [command, ...rest] = argv;
+  if (command === undefined) {
+    io.stderr(helpText());
+    return 0;
+  }
+  if (command === "login")
+    return login();
+  if (command === "credential-helper")
+    return credentialHelper(rest);
+  if (isEngine(command))
+    return runEngine(command, rest, tagPrefix, cachePrefix, ociLabels);
+  io.stderr(helpText());
+  return 1;
+}
+async function entry(argv) {
+  try {
+    process.exit(await main(argv));
+  } catch (exc) {
+    if (!(exc instanceof CeError))
+      throw exc;
+    logError(exc.message);
+    process.exit(2);
+  }
+}
+export {
+  entry,
+  helpText,
+  main
+};