@izykitten/ce 0.0.3-dev.1 → 0.0.3-dev.10

package/dist/ce.js

@@ -1,116 +1,3 @@
-// src/command.ts
-var VALUE_OPTIONS = {
-  docker: {
-    long: new Set(["config", "context", "host", "log-level", "tlscacert", "tlscert", "tlskey", "builder"]),
-    short: "cHl"
-  },
-  podman: {
-    long: new Set([
-      "cdi-spec-dir",
-      "cgroup-manager",
-      "cni-config-dir",
-      "config",
-      "conmon",
-      "connection",
-      "context",
-      "cpu-profile",
-      "db-backend",
-      "default-mounts-file",
-      "events-backend",
-      "hooks-dir",
-      "host",
-      "identity",
-      "imagestore",
-      "log-level",
-      "max-workers",
-      "memory-profile",
-      "module",
-      "namespace",
-      "network-backend",
-      "network-cmd-path",
-      "network-config-dir",
-      "out",
-      "pull-option",
-      "registries-conf",
-      "root",
-      "runroot",
-      "runtime",
-      "runtime-flag",
-      "ssh",
-      "storage-driver",
-      "storage-opt",
-      "tmpdir",
-      "url",
-      "volumepath"
-    ]),
-    short: "cH"
-  },
-  buildah: {
-    long: new Set([
-      "cgroup-manager",
-      "cpu-profile",
-      "default-mounts-file",
-      "experimental-timeout",
-      "imagestore",
-      "log-level",
-      "memory-profile",
-      "registries-conf",
-      "registries-conf-dir",
-      "root",
-      "runroot",
-      "short-name-alias-conf",
-      "storage-driver",
-      "storage-opt",
-      "userns-gid-map",
-      "userns-uid-map"
-    ]),
-    short: ""
-  }
-};
-function takesNext(engine, arg) {
-  const options = VALUE_OPTIONS[engine];
-  if (arg.startsWith("--"))
-    return options.long.has(arg.slice(2));
-  for (let j = 1;j < arg.length; j++) {
-    if (options.short.includes(arg[j]))
-      return j === arg.length - 1;
-  }
-  return false;
-}
-var COMMANDS = {
-  docker: [
-    { words: ["build"] },
-    { words: ["image", "build"] },
-    { words: ["builder", "build"] },
-    { words: ["buildx", "build"] },
-    { words: ["buildx", "b"] },
-    { words: ["buildx", "imagetools", "create"], tagsOnly: true }
-  ],
-  podman: [{ words: ["build"] }, { words: ["image", "build"] }, { words: ["buildx", "build"] }],
-  buildah: [{ words: ["build"] }, { words: ["bud"] }]
-};
-function findBuildCommand(engine, argv) {
-  const words = [];
-  for (let i = 0;i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg === "--")
-      return null;
-    if (arg.startsWith("-")) {
-      if (takesNext(engine, arg))
-        i++;
-      continue;
-    }
-    words.push(arg);
-    const candidates = COMMANDS[engine].filter((command) => words.every((word, j) => command.words[j] === word));
-    const match = candidates.find((command) => command.words.length === words.length);
-    if (match)
-      return { start: i + 1, name: arg, tagsOnly: match.tagsOnly ?? false };
-    if (!candidates.length)
-      return null;
-  }
-  return null;
-}
-
 // src/errors.ts
 class CeError extends Error {
   name = "CeError";
@@ -210,190 +97,237 @@ function registryKey(value) {
   return registryServer(value).toLowerCase();
 }
 
-// src/metadata.ts
-var CI_VARIABLES = [
-  "image",
-  "ref",
-  "branch",
-  "pr",
-  "tag",
-  "default",
-  "revision",
-  "sha",
-  "version",
-  "major",
-  "minor",
-  "patch",
-  "stable"
-];
-var ENV_VARIABLE = /^env\.([A-Za-z_][A-Za-z0-9_]*)$/u;
-var SEMVER = /^v?((0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?)$/u;
-var nonEmpty = (value) => value ? value : undefined;
-
-class CiMetadata {
-  #env;
-  #cache = new Map;
-  #ref;
-  #event;
-  constructor(env = process.env) {
-    this.#env = env;
-  }
-  known(name) {
-    return CI_VARIABLES.includes(name) || ENV_VARIABLE.test(name);
-  }
-  get(name) {
-    const envName = ENV_VARIABLE.exec(name)?.[1];
-    if (envName)
-      return nonEmpty(this.#env[envName]);
-    if (!this.#cache.has(name))
-      this.#cache.set(name, this.#resolve(name));
-    return this.#cache.get(name);
-  }
-  labels() {
-    const labels = {};
-    const add = (key, value) => {
-      try {
-        const v = value();
-        if (v)
-          labels[`org.opencontainers.image.${key}`] = v;
-      } catch (exc) {
-        if (!(exc instanceof CeError))
-          throw exc;
-      }
+// src/oidc.ts
+var REFRESH_WINDOW_S = 5 * 60;
+var REQUEST_TIMEOUT_MS = 30000;
+var decodeUtf8 = (bytes) => new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+async function forgejoOidcJwt(audience, requestUrl, requestToken) {
+  assertAbsoluteHttpUrl(requestUrl, "token request URL must be an absolute HTTP(S) URL");
+  let tokenUrl;
+  let headers;
+  try {
+    const url = new URL(requestUrl);
+    if (url.username || url.password)
+      throw new Error("credentials in URL");
+    url.searchParams.set("audience", audience);
+    tokenUrl = url.href;
+    headers = {
+      Accept: "application/json",
+      Authorization: `bearer ${requestToken}`
     };
-    const server = nonEmpty(this.#ciEnv("SERVER_URL"))?.replace(/\/+$/u, "");
-    const repository = nonEmpty(this.#ciEnv("REPOSITORY"));
-    add("source", () => server && repository ? `${server}/${repository}` : undefined);
-    add("revision", () => this.#ciEnv("SHA"));
-    add("version", () => this.get("version") ?? this.#rawRef());
-    add("title", () => repository?.split("/").at(-1));
-    add("description", () => {
-      const repo = this.#payload().repository;
-      return isObject(repo) && typeof repo.description === "string" ? repo.description : undefined;
-    });
-    return labels;
-  }
-  #resolve(name) {
-    switch (name) {
-      case "image": {
-        const server = this.#require("SERVER_URL", "{image}");
-        const repository = this.#require("REPOSITORY", "{image}");
-        return `${registryServer(server)}/${repository}`.toLowerCase();
-      }
-      case "ref":
-        return this.#rawRef();
-      case "branch": {
-        const ref = this.#parsedRef();
-        return ref.kind === "branch" ? ref.name : undefined;
-      }
-      case "tag": {
-        const ref = this.#parsedRef();
-        return ref.kind === "tag" ? ref.name : undefined;
-      }
-      case "pr": {
-        const ref = this.#parsedRef();
-        return ref.kind === "pr" ? ref.number : undefined;
-      }
-      case "default": {
-        const ref = this.#parsedRef();
-        if (ref.kind !== "branch")
-          return;
-        return ref.name === this.#defaultBranch() ? ref.name : undefined;
-      }
-      case "revision":
-        return this.#require("SHA", `{${name}}`);
-      case "sha":
-        return this.#require("SHA", `{${name}}`).slice(0, 7);
-      case "version":
-        return this.#semver()?.[1];
-      case "major":
-        return this.#semver()?.[2];
-      case "minor":
-        return this.#semver()?.[3];
-      case "patch":
-        return this.#semver()?.[4];
-      case "stable": {
-        const semver = this.#semver();
-        return semver && semver[5] === undefined ? semver[1] : undefined;
-      }
-    }
-    throw new CeError(`ce: unknown placeholder {${name}}`);
+    new Headers(headers);
+  } catch {
+    throw new CeError("token request URL or headers are invalid");
   }
-  #ciEnv(name) {
-    return nonEmpty(this.#env[`FORGEJO_${name}`]) ?? nonEmpty(this.#env[`GITHUB_${name}`]);
+  let body;
+  try {
+    const response = await fetch(tokenUrl, {
+      headers,
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
+    if (!response.ok)
+      throw new Error(`HTTP ${response.status} ${response.statusText}`);
+    body = await response.arrayBuffer();
+  } catch (exc) {
+    throw new CeError(`token request failed: ${errorMessage(exc)}`);
   }
-  #require(name, user) {
-    const value = this.#ciEnv(name);
-    if (!value) {
-      throw new CeError(`ce: ${user} needs GITHUB_${name} (or FORGEJO_${name}), which is not set; is this a Forgejo Actions run?`);
-    }
-    return value;
+  let payload;
+  try {
+    payload = JSON.parse(decodeUtf8(body));
+  } catch {
+    throw new CeError("token response is not valid UTF-8 JSON");
   }
-  #rawRef() {
-    const ref = this.#parsedRef();
-    return ref.kind === "pr" ? `pr-${ref.number}` : ref.name;
+  if (!isObject(payload))
+    throw new CeError("token response is not a JSON object");
+  const jwt = payload.value;
+  if (typeof jwt !== "string" || !jwt.trim()) {
+    throw new CeError("token response has no non-empty string 'value'");
   }
-  #parsedRef() {
-    if (this.#ref)
-      return this.#ref;
-    const ref = this.#require("REF", "{ref}, {branch}, {tag} or {pr}");
-    const event = this.#ciEnv("EVENT_NAME") ?? "";
-    const pull = /^refs\/pull\/(\d+)\//u.exec(ref);
-    if (event.startsWith("pull_request") || pull) {
-      const payload = pull ? {} : this.#payload();
-      const fromPayload = [isObject(payload.pull_request) && payload.pull_request.number, payload.number].find(Number.isInteger);
-      const number = pull?.[1] ?? (fromPayload === undefined ? undefined : String(fromPayload));
-      if (!number)
-        throw new CeError(`ce: cannot find the pull request number for ${event} on ${ref}`);
-      this.#ref = { kind: "pr", number };
-    } else if (ref.startsWith("refs/heads/")) {
-      this.#ref = { kind: "branch", name: ref.slice("refs/heads/".length) };
-    } else if (ref.startsWith("refs/tags/")) {
-      this.#ref = { kind: "tag", name: ref.slice("refs/tags/".length) };
-    } else {
-      throw new CeError(`ce: cannot tell what ${JSON.stringify(ref)} is: not a branch, tag or pull request`);
-    }
-    return this.#ref;
+  return jwt.trim();
+}
+function jwtExpiry(jwt) {
+  const parts = jwt.split(".");
+  if (parts.length !== 3)
+    throw new CeError("OIDC token is not a three-part JWT");
+  let payload;
+  try {
+    payload = JSON.parse(decodeUtf8(Buffer.from(parts[1], "base64url")));
+  } catch {
+    throw new CeError("OIDC token has an invalid JWT payload");
   }
-  #semver() {
-    const ref = this.#parsedRef();
-    return ref.kind === "tag" ? SEMVER.exec(ref.name) : null;
+  const expiry = isObject(payload) ? payload.exp : undefined;
+  if (typeof expiry !== "number")
+    throw new CeError("OIDC token has no numeric 'exp' claim");
+  return expiry;
+}
+function needsRefresh(expiry) {
+  return expiry <= Date.now() / 1000 + REFRESH_WINDOW_S;
+}
+
+// src/state.ts
+import fs3 from "node:fs";
+import { homedir } from "node:os";
+import path2 from "node:path";
+
+// src/lock.ts
+import fs2 from "node:fs";
+import { hostname } from "node:os";
+import { setTimeout } from "node:timers/promises";
+var STALE_AFTER_MS = 120000;
+var POLL_MS = 50;
+function snapshot(lockPath) {
+  try {
+    const { ino, mtimeMs } = fs2.statSync(lockPath);
+    return { ino, mtimeMs, owner: fs2.readFileSync(lockPath, "utf8").trim() };
+  } catch (exc) {
+    if (isErrno(exc, "ENOENT"))
+      return null;
+    throw exc;
   }
-  #defaultBranch() {
-    const repository = this.#ciEnv("EVENT_PATH") ? this.#payload().repository : undefined;
-    const fromEvent = isObject(repository) ? repository.default_branch : undefined;
-    const branch = typeof fromEvent === "string" && fromEvent || nonEmpty(this.#env.DEFAULT_BRANCH);
-    if (!branch) {
-      throw new CeError("ce: {default} needs repository.default_branch in the event file or DEFAULT_BRANCH, and neither is set");
+}
+function isStale({ mtimeMs, owner }) {
+  if (Date.now() - mtimeMs > STALE_AFTER_MS)
+    return true;
+  const match = /^(\d+)@(.*)$/u.exec(owner);
+  if (!match || match[2] !== hostname())
+    return false;
+  try {
+    process.kill(Number(match[1]), 0);
+    return false;
+  } catch (exc) {
+    return !isErrno(exc, "EPERM");
+  }
+}
+function breakIfStale(lockPath) {
+  const stale = snapshot(lockPath);
+  if (!stale || !isStale(stale))
+    return;
+  const guard = `${lockPath}.break`;
+  try {
+    fs2.writeFileSync(guard, "", { flag: "wx", mode: 384 });
+  } catch (exc) {
+    if (!isErrno(exc, "EEXIST"))
+      throw exc;
+    const held = snapshot(guard);
+    if (held && Date.now() - held.mtimeMs > STALE_AFTER_MS) {
+      throw new CeError(`stale lock guard ${JSON.stringify(guard)}: remove it if no ce is running`);
     }
-    return branch;
+    return;
   }
-  #payload() {
-    if (this.#event)
-      return this.#event;
-    const file = this.#require("EVENT_PATH", "reading the event file");
-    let payload;
+  try {
+    const current = snapshot(lockPath);
+    if (current && current.ino === stale.ino && current.mtimeMs === stale.mtimeMs && current.owner === stale.owner) {
+      fs2.rmSync(lockPath, { force: true });
+    }
+  } finally {
+    fs2.rmSync(guard, { force: true });
+  }
+}
+async function withFileLock(lockPath, fn) {
+  const owner = `${process.pid}@${hostname()}`;
+  let ino;
+  for (;; ) {
+    let fd;
     try {
-      payload = readJsonFile(file, undefined);
+      fd = fs2.openSync(lockPath, "wx", 384);
     } catch (exc) {
-      throw new CeError(`ce: ${errorMessage(exc)}`);
+      if (!isErrno(exc, "EEXIST"))
+        throw exc;
+      breakIfStale(lockPath);
+      await setTimeout(POLL_MS);
+      continue;
+    }
+    try {
+      fs2.writeSync(fd, `${owner}
+`);
+      ino = fs2.fstatSync(fd).ino;
+    } finally {
+      fs2.closeSync(fd);
+    }
+    break;
+  }
+  try {
+    return await fn();
+  } finally {
+    const current = snapshot(lockPath);
+    if (current?.ino === ino && current.owner === owner)
+      fs2.rmSync(lockPath, { force: true });
+  }
+}
+
+// src/state.ts
+var HELPER_SUFFIX = "ce-forgejo";
+var STATE_FILE = "ce-forgejo-credentials.json";
+function dockerConfigDir() {
+  const configured = process.env.DOCKER_CONFIG;
+  if (!configured)
+    return path2.join(homedir(), ".docker");
+  const expanded = configured === "~" || configured.startsWith("~/") ? path2.join(homedir(), configured.slice(1)) : configured;
+  return path2.resolve(expanded);
+}
+function helperStatePath() {
+  return path2.join(dockerConfigDir(), STATE_FILE);
+}
+async function withHelperState(fn) {
+  const statePath = helperStatePath();
+  fs3.mkdirSync(path2.dirname(statePath), { recursive: true, mode: 448 });
+  return withFileLock(`${statePath}.pidlock`, async () => {
+    const state = readJsonFile(statePath, { version: 1, registries: {} });
+    if (!isObject(state) || !isObject(state.registries)) {
+      throw new CeError("Forgejo credential-helper state is invalid");
+    }
+    const before = JSON.stringify(state);
+    const result = await fn(state);
+    if (JSON.stringify(state) !== before)
+      writePrivateJson(statePath, state);
+    return result;
+  });
+}
+async function saveHelperState(registry, username, audience, authority, jwt) {
+  const expiry = jwtExpiry(jwt);
+  if (needsRefresh(expiry))
+    throw new CeError("OIDC token expires within the five-minute refresh window");
+  await withHelperState((state) => {
+    state.registries[registryKey(registry)] = {
+      audience,
+      authority: [authority[0], authority[1]],
+      expires_at: expiry,
+      token: jwt,
+      username
+    };
+  });
+}
+async function configureDockerCredentialHelper(registry, username, audience, authority, jwt) {
+  await saveHelperState(registry, username, audience, authority, jwt);
+  const configPath = path2.join(dockerConfigDir(), "config.json");
+  const config = readJsonFile(configPath, {});
+  if (!isObject(config))
+    throw new CeError("Docker config is not a JSON object");
+  config.credHelpers ??= {};
+  const helpers = config.credHelpers;
+  if (!isObject(helpers))
+    throw new CeError("Docker config 'credHelpers' is not a JSON object");
+  helpers[registry] = HELPER_SUFFIX;
+  const auths = config.auths;
+  if (isObject(auths)) {
+    for (const key of Object.keys(auths)) {
+      if (registryKey(key) === registryKey(registry))
+        delete auths[key];
     }
-    if (!isObject(payload))
-      throw new CeError(`ce: the event file ${JSON.stringify(file)} is missing or not a JSON object`);
-    this.#event = payload;
-    return payload;
   }
+  writePrivateJson(configPath, config);
 }
 
 // src/system.ts
 import { spawnSync } from "node:child_process";
-import fs2 from "node:fs";
-import path2 from "node:path";
-import { setTimeout } from "node:timers/promises";
+import fs4 from "node:fs";
+import path3 from "node:path";
+import { constants as osConstants } from "node:os";
+import { setTimeout as setTimeout2 } from "node:timers/promises";
 var io = {
-  stdout: (text) => void fs2.writeSync(1, text),
-  stderr: (text) => void fs2.writeSync(2, text),
-  stdin: () => fs2.readFileSync(0, "utf8"),
+  stdout: (text) => void fs4.writeSync(1, text),
+  stderr: (text) => void fs4.writeSync(2, text),
+  stdin: () => fs4.readFileSync(0, "utf8"),
   argv0: () => process.argv[1] ?? "ce"
 };
 function log(line) {
@@ -404,15 +338,33 @@ function logError(line) {
   io.stderr(`${line}
 `);
 }
-function childEnv() {
-  return Object.fromEntries(Object.entries(process.env).filter((entry) => entry[1] !== undefined));
+function envFlag(name, unset = false, allowed = "true or false") {
+  const value = (process.env[name] ?? "").toLowerCase();
+  if (value === "")
+    return unset;
+  if (["0", "false", "no"].includes(value))
+    return false;
+  if (["1", "true", "yes"].includes(value))
+    return true;
+  throw new CeError(`ce: ${name} must be ${allowed}, not ${JSON.stringify(process.env[name])}`);
+}
+function envValue(name, flag) {
+  if (!/^[A-Za-z_][A-Za-z\d_]*$/u.test(name))
+    throw new CeError(`ce: ${flag} requires an environment variable name`);
+  return process.env[name] ?? "";
+}
+function shellQuote(arg) {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/u.test(arg) ? arg : `'${arg.replaceAll("'", `'\\''`)}'`;
+}
+function childEnv(overrides = {}) {
+  return Object.fromEntries(Object.entries({ ...process.env, ...overrides }).filter((entry) => entry[1] !== undefined));
 }
 function which(command) {
-  const candidates = command.includes("/") ? [command] : (process.env.PATH ?? "").split(path2.delimiter).filter(Boolean).map((dir) => path2.join(dir, command));
+  const candidates = command.includes("/") ? [command] : (process.env.PATH ?? "").split(path3.delimiter).filter(Boolean).map((dir) => path3.join(dir, command));
   for (const candidate of candidates) {
     try {
-      fs2.accessSync(candidate, fs2.constants.X_OK);
-      if (fs2.statSync(candidate).isFile())
+      fs4.accessSync(candidate, fs4.constants.X_OK);
+      if (fs4.statSync(candidate).isFile())
         return candidate;
     } catch {}
   }
@@ -420,11 +372,11 @@ function which(command) {
 }
 var system = {
   which,
-  run(argv, input) {
+  run(argv, input, env) {
     const result = spawnSync(argv[0], argv.slice(1), {
       input,
       stdio: [input === undefined ? "ignore" : "pipe", "ignore", "pipe"],
-      env: childEnv(),
+      env: childEnv(env),
       encoding: "utf8",
       maxBuffer: Infinity
     });
@@ -432,773 +384,2290 @@ var system = {
       throw result.error;
     return { status: result.status ?? 1, stderr: result.stderr ?? "" };
   },
-  sleep: (ms) => setTimeout(ms),
-  exec(file, argv) {
+  output(argv) {
+    const result = spawnSync(argv[0], argv.slice(1), {
+      stdio: ["ignore", "pipe", "ignore"],
+      env: childEnv(),
+      encoding: "utf8"
+    });
+    if (result.error)
+      throw result.error;
+    return { status: result.status ?? 1, stdout: result.stdout ?? "" };
+  },
+  capture(argv, env) {
+    const result = spawnSync(argv[0], argv.slice(1), {
+      stdio: ["ignore", "pipe", "pipe"],
+      env: childEnv(env),
+      encoding: "utf8",
+      maxBuffer: Infinity
+    });
+    if (result.error)
+      throw result.error;
+    return {
+      status: result.status ?? (result.signal ? 128 + osConstants.signals[result.signal] : 1),
+      stdout: result.stdout ?? "",
+      stderr: result.stderr ?? ""
+    };
+  },
+  sleep: (ms) => setTimeout2(ms),
+  sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+  },
+  exec(file, argv, env) {
     const resolved = system.which(file);
     if (!resolved) {
       logError(`ce: ${file} not found on PATH`);
       return 1;
     }
-    process.execve(resolved, argv, childEnv());
+    process.execve(resolved, argv, childEnv(env));
     throw new Error(`execve returned for ${file}`);
   }
 };
 function binDir() {
-  return fs2.realpathSync(path2.join(import.meta.dirname, "..", "bin"));
+  return fs4.realpathSync(path3.join(import.meta.dirname, "..", "bin"));
 }
 function ensureHelperOnPath() {
   const dir = binDir();
-  const parts = (process.env.PATH ?? "").split(path2.delimiter);
+  const parts = (process.env.PATH ?? "").split(path3.delimiter);
   if (!parts.includes(dir))
-    process.env.PATH = [dir, ...parts].join(path2.delimiter);
+    process.env.PATH = [dir, ...parts].join(path3.delimiter);
 }
 
-// src/template.ts
-var PLACEHOLDER = /\{([^{}]*)\}/gu;
-function hasPlaceholders(value) {
-  return value.includes("{") || value.includes("}");
-}
-function parse(template, vars) {
-  const parts = [];
-  const text = (value) => {
-    if (hasPlaceholders(value))
-      throw new CeError(`ce: unmatched brace in ${JSON.stringify(template)}`);
-    if (value)
-      parts.push({ text: value });
-  };
-  let last = 0;
-  for (const match of template.matchAll(PLACEHOLDER)) {
-    text(template.slice(last, match.index));
-    last = match.index + match[0].length;
-    const guard = match[1].startsWith("?");
-    const name = guard ? match[1].slice(1) : match[1];
-    if (!vars.known(name))
-      throw new CeError(`ce: unknown placeholder ${match[0]} in ${JSON.stringify(template)}`);
-    parts.push({ name, guard });
-  }
-  text(template.slice(last));
-  return parts;
-}
-function expand(template, vars, encode) {
-  const parts = parse(template, vars);
-  for (const part of parts) {
-    if ("name" in part && part.guard && vars.get(part.name) === undefined)
-      return null;
-  }
-  let out = "";
-  for (const part of parts) {
-    if ("text" in part)
-      out += part.text;
-    else if (!part.guard) {
-      const value = vars.get(part.name);
-      if (value === undefined) {
-        throw new CeError(`ce: {${part.name}} has no value here, in ${JSON.stringify(template)}. ` + `To leave the tag out instead, guard it with {?${part.name}}.`);
-      }
-      out += encode(value);
+// src/credential-helper.ts
+async function helperGet(registry) {
+  const key = registryKey(registry);
+  return withHelperState(async (state) => {
+    const entry = state.registries[key];
+    if (!isObject(entry)) {
+      throw new CeError(`no Forgejo OIDC credentials configured for ${JSON.stringify(registry)}`);
     }
-  }
-  return out;
+    const { username, token, expires_at: expiry } = entry;
+    if (typeof username !== "string" || !username) {
+      throw new CeError("Forgejo credential-helper username is missing");
+    }
+    if (typeof token !== "string" || typeof expiry !== "number") {
+      throw new CeError("Forgejo credential-helper token state is invalid");
+    }
+    if (!needsRefresh(expiry))
+      return { Username: username, Secret: token };
+    const { audience, authority } = entry;
+    const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL ?? "";
+    const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN ?? "";
+    if (typeof audience !== "string" || !audience) {
+      throw new CeError("Forgejo credential-helper audience is missing");
+    }
+    if (!(requestUrl && requestToken)) {
+      throw new CeError("OIDC refresh requires ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN");
+    }
+    const [host, port] = urlAuthority(requestUrl);
+    if (!Array.isArray(authority) || authority.length !== 2 || authority[0] !== host || authority[1] !== port) {
+      throw new CeError("OIDC token-request host does not match the registry");
+    }
+    const refreshed = await forgejoOidcJwt(audience, requestUrl, requestToken);
+    const refreshedExpiry = jwtExpiry(refreshed);
+    if (needsRefresh(refreshedExpiry)) {
+      throw new CeError("refreshed OIDC token expires within the five-minute window");
+    }
+    entry.token = refreshed;
+    entry.expires_at = refreshedExpiry;
+    return { Username: username, Secret: refreshed };
+  });
 }
-function checkValue(template, vars, what) {
-  if (parse(template, vars).some((part) => ("guard" in part) && part.guard)) {
-    throw new CeError(`ce: ${what} ${JSON.stringify(template)} cannot use {?guards}; they only apply to tags`);
+async function helperStore(input) {
+  const payload = JSON.parse(input);
+  if (!isObject(payload))
+    throw new CeError("credential-helper store payload is invalid");
+  const { ServerURL: registry, Username: username, Secret: secret } = payload;
+  const filled = (value) => typeof value === "string" && value !== "";
+  if (!(filled(registry) && filled(username) && filled(secret))) {
+    throw new CeError("credential-helper store fields are incomplete");
   }
+  const expiry = jwtExpiry(secret);
+  await withHelperState((state) => {
+    const entry = state.registries[registryKey(registry)] ??= {};
+    Object.assign(entry, { expires_at: expiry, token: secret, username });
+  });
 }
-function expandValue(template, vars, encode, what) {
-  checkValue(template, vars, what);
-  for (const part of parse(template, vars)) {
-    if ("name" in part && vars.get(part.name) === undefined) {
-      throw new CeError(`ce: {${part.name}} has no value here, in the ${what} ${JSON.stringify(template)}`);
+async function credentialHelper(argv) {
+  const [command] = argv;
+  if (argv.length !== 1 || !["get", "store", "erase", "list"].includes(command)) {
+    logError("ce: credential-helper requires get|store|erase|list");
+    return 1;
+  }
+  try {
+    if (command === "get") {
+      io.stdout(`${JSON.stringify(await helperGet(io.stdin().trim()))}
+`);
+    } else if (command === "store") {
+      await helperStore(io.stdin());
+    } else if (command === "erase") {
+      const key = registryKey(io.stdin().trim());
+      await withHelperState((state) => void delete state.registries[key]);
+    } else {
+      const entries = await withHelperState((state) => Object.fromEntries(Object.entries(state.registries).filter(([, entry]) => isObject(entry)).map(([key, entry]) => [key, entry.username ?? ""])));
+      io.stdout(`${JSON.stringify(entries)}
+`);
     }
+    return 0;
+  } catch (exc) {
+    if (!(exc instanceof CeError || exc instanceof SyntaxError || isErrno(exc)))
+      throw exc;
+    logError(`ce: Forgejo credential helper: ${errorMessage(exc)}`);
+    return 1;
   }
-  return expand(template, vars, encode);
 }
 
-// src/tags.ts
-var INVALID_TAG_CHARS = /[^A-Za-z0-9_.\-]/gu;
-var INVALID_SCOPE_CHARS = /[^A-Za-z0-9_.:/\-]/gu;
-var VALID_TAG = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/u;
-var HOST_PORT = /^([^/:]+):(?:\d|\{[^{}]*\})+\//u;
-var SEPARATORS = "-_.";
-function sanitizeChars(value, charRegex) {
-  return value.replace(charRegex, "_");
+// src/command.ts
+var VALUE_OPTIONS = {
+  docker: {
+    long: new Set([
+      "config",
+      "context",
+      "host",
+      "log-level",
+      "tlscacert",
+      "tlscert",
+      "tlskey",
+      "builder"
+    ]),
+    short: "cHl"
+  },
+  podman: {
+    long: new Set([
+      "cdi-spec-dir",
+      "cgroup-manager",
+      "cni-config-dir",
+      "config",
+      "conmon",
+      "connection",
+      "context",
+      "cpu-profile",
+      "db-backend",
+      "default-mounts-file",
+      "events-backend",
+      "hooks-dir",
+      "host",
+      "identity",
+      "imagestore",
+      "log-level",
+      "max-workers",
+      "memory-profile",
+      "module",
+      "namespace",
+      "network-backend",
+      "network-cmd-path",
+      "network-config-dir",
+      "out",
+      "pull-option",
+      "registries-conf",
+      "root",
+      "runroot",
+      "runtime",
+      "runtime-flag",
+      "ssh",
+      "storage-driver",
+      "storage-opt",
+      "tmpdir",
+      "url",
+      "volumepath"
+    ]),
+    short: "cH"
+  },
+  buildah: {
+    long: new Set([
+      "cgroup-manager",
+      "cpu-profile",
+      "default-mounts-file",
+      "experimental-timeout",
+      "imagestore",
+      "log-level",
+      "memory-profile",
+      "registries-conf",
+      "registries-conf-dir",
+      "root",
+      "runroot",
+      "short-name-alias-conf",
+      "storage-driver",
+      "storage-opt",
+      "userns-gid-map",
+      "userns-uid-map"
+    ]),
+    short: ""
+  }
+};
+function takesNext(engine, arg) {
+  const options = VALUE_OPTIONS[engine];
+  if (arg.startsWith("--"))
+    return options.long.has(arg.slice(2));
+  for (let j = 1;j < arg.length; j++) {
+    if (options.short.includes(arg[j]))
+      return j === arg.length - 1;
+  }
+  return false;
 }
-function assertAscii(label, value) {
-  for (const ch of value) {
-    const code = ch.codePointAt(0);
-    if (code >= 128) {
-      const hex = code.toString(16).toUpperCase().padStart(4, "0");
-      throw new CeError(`ce: refusing to sanitize non-ASCII character ${JSON.stringify(ch)} ` + `(U+${hex}) in ${label} ${JSON.stringify(value)} — rename the ref ` + `or pass an explicit ASCII tag.`);
+var COMMANDS = {
+  docker: [
+    { words: ["build"] },
+    { words: ["image", "build"] },
+    { words: ["builder", "build"] },
+    { words: ["buildx", "build"] },
+    { words: ["buildx", "b"] },
+    { words: ["buildx", "imagetools", "create"], tagsOnly: true }
+  ],
+  podman: [
+    { words: ["build"] },
+    { words: ["image", "build"] },
+    { words: ["buildx", "build"] }
+  ],
+  buildah: [{ words: ["build"] }, { words: ["bud"] }]
+};
+function findBuildCommand(engine, argv) {
+  const words = [];
+  const options = [];
+  let global = 0;
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--")
+      return null;
+    if (arg.startsWith("-")) {
+      options.push(arg);
+      if (takesNext(engine, arg) && i + 1 < argv.length)
+        options.push(argv[++i]);
+      continue;
     }
+    if (!words.length)
+      global = options.length;
+    words.push(arg);
+    const candidates = COMMANDS[engine].filter((command) => words.every((word, j) => command.words[j] === word));
+    const match = candidates.find((command) => command.words.length === words.length);
+    if (match)
+      return {
+        start: i + 1,
+        name: arg,
+        tagsOnly: match.tagsOnly ?? false,
+        engineOptions: engine === "docker" ? options.slice(0, global) : options,
+        buildx: words[0] === "buildx"
+      };
+    if (!candidates.length)
+      return null;
   }
+  return null;
 }
-function stripProto(value) {
-  return value.replace(/^https?:\/\//u, "");
-}
-function splitOnce(value, sep) {
-  const i = value.indexOf(sep);
-  return i < 0 ? [value, ""] : [value.slice(0, i), value.slice(i + sep.length)];
+
+// src/containerfile.ts
+import fs5 from "node:fs";
+import path4 from "node:path";
+var engineEscapes = (value) => /[^\p{L}\p{M}\p{N}\p{P}\p{S} ]/u.test(value);
+
+class Unreadable extends Error {
+  located = false;
+  hint = "";
 }
-function splitRef(value) {
-  const host = HOST_PORT.exec(value);
-  const isHost = host && (host[1].includes(".") || host[1] === "localhost" || value.includes(":", host[0].length));
-  const offset = isHost ? host[0].length : 0;
-  const i = value.indexOf(":", offset);
-  return i < 0 ? null : [value.slice(0, i), value.slice(i + 1)];
+var fail = (message) => {
+  throw new Unreadable(message);
+};
+var STANDARD_SYNTAX = /^(?:docker\.io\/)?docker\/dockerfile(?:-upstream)?(?::(?:1|latest|labs|master|1-labs|master-labs|1\.(?:2[1-9]|[3-9]\d|\d{3,})(?:\.\d+)?(?:-[\w.]+)?(?:@sha256:[0-9a-f]{64})?))?$/u;
+var isRemote = (value) => value === "-" || value.includes("://") || /^(?:git@|github\.com\/)/u.test(value);
+var familiar = (name) => name.replace(/^(?:(?:index\.)?docker\.io\/)?(?:library\/(?=[^/]+$))?/u, "").replace(/:latest$/u, "");
+function findContainerfile(files, cwd = process.cwd()) {
+  try {
+    const file = locate(files, cwd);
+    if (files.engine !== "docker" && file.endsWith(".in"))
+      fail(`${files.engine} runs ${JSON.stringify(file)} through cpp, which ce does not`);
+    return file;
+  } catch (exc) {
+    if (exc instanceof Unreadable)
+      throw exc;
+    return fail(`ce cannot look for the Containerfile: ${errorMessage(exc)}`);
+  }
+}
+function locate({ engine, files, positionals }, cwd) {
+  const docker = engine === "docker";
+  if (positionals.length > 1)
+    fail(`ce cannot tell which of ${positionals.map((p) => JSON.stringify(p)).join(", ")} is the build context`);
+  const context = positionals[0] ?? (docker ? fail("the command has no build context") : ".");
+  if (isRemote(context))
+    fail(`the build context ${JSON.stringify(context)} is not a local directory`);
+  const contextDir = path4.resolve(cwd, context);
+  if (!docker && (files.length > 1 || files.some((f) => f.includes(","))))
+    fail(`ce does not read ${engine}'s several -f files`);
+  const file = files.at(-1) || undefined;
+  if (file === undefined && files.length && !docker)
+    fail("the -f is empty");
+  if (docker) {
+    if (file !== undefined && isRemote(file))
+      fail(`-f ${JSON.stringify(file)} is not a local file`);
+    return lowercaseDockerfile(file === undefined ? path4.join(contextDir, "Dockerfile") : path4.resolve(cwd, file));
+  }
+  if (file !== undefined) {
+    if (isRemote(file))
+      fail(`-f ${JSON.stringify(file)} is not a local file`);
+    const given = path4.resolve(cwd, file);
+    return fs5.existsSync(given) ? given : path4.resolve(contextDir, file);
+  }
+  if (fs5.statSync(contextDir, { throwIfNoEntry: false })?.isFile())
+    return contextDir;
+  const containerfile = path4.join(contextDir, "Containerfile");
+  return fs5.existsSync(containerfile) ? containerfile : path4.join(contextDir, "Dockerfile");
+}
+function lowercaseDockerfile(file) {
+  if (path4.basename(file) !== "Dockerfile")
+    return file;
+  let names;
+  try {
+    names = fs5.readdirSync(path4.dirname(file));
+  } catch {
+    return file;
+  }
+  return !names.includes("Dockerfile") && names.includes("dockerfile") ? path4.join(path4.dirname(file), "dockerfile") : file;
+}
+var SPACE = "\\t\\n\\v\\f\\r \\u0085\\u00a0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000";
+var IS_SPACE = new RegExp(`[${SPACE}]`, "u");
+var TRIM_START = new RegExp(`^[${SPACE}]+`, "u");
+var UNUSUAL_SPACE = /[\u0085\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]/u;
+var NON_ASCII = /[^\0-\x7f]/u;
+function instructionOf(word, line) {
+  if (NON_ASCII.test(word))
+    fail(`ce cannot read the instruction ${JSON.stringify(word)} on line ${line}`);
+  return word.toUpperCase();
+}
+var stageKey = (name) => NON_ASCII.test(name) ? fail(`ce reads only ASCII stage names, not ${JSON.stringify(name)}`) : name.toLowerCase();
+function trimEnd(text, space) {
+  let end = text.length;
+  while (end > 0 && space.test(text[end - 1]))
+    end--;
+  return text.slice(0, end);
+}
+var trim = (text) => trimEnd(text.replace(TRIM_START, ""), IS_SPACE);
+var COMMAND = /^([^\t\v\f\r ]+)[\t\v\f\r ]*([\s\S]*)$/u;
+function words(text, escape, heredoc = false) {
+  const out = [];
+  let word = "";
+  let quote = "";
+  let inWord = false;
+  for (let i = 0;i < text.length; i++) {
+    const ch = text[i];
+    if (!quote && IS_SPACE.test(ch)) {
+      if (inWord)
+        out.push(word);
+      [word, inWord] = ["", false];
+      continue;
+    }
+    inWord = true;
+    if (ch === escape && quote !== "'" && i + 1 === text.length)
+      continue;
+    word += ch;
+    if (heredoc && !quote && ch === "<" && text[i + 1] === "<") {
+      word += text[++i];
+      while (/[ \t\r]/u.test(text[i + 1] ?? ""))
+        word += text[++i];
+    } else if (ch === escape && quote !== "'" && i + 1 < text.length)
+      word += text[++i];
+    else if (ch === quote)
+      quote = "";
+    else if (!quote && (ch === '"' || ch === "'"))
+      quote = ch;
+  }
+  if (quote)
+    fail(`unterminated ${quote} in ${JSON.stringify(text)}`);
+  if (inWord)
+    out.push(word);
+  return out;
 }
-function assertValidTag(repo, tag) {
-  if (!VALID_TAG.test(tag)) {
-    throw new CeError(`ce: invalid tag ${JSON.stringify(tag)} in ${JSON.stringify(`${repo}:${tag}`)}: a tag is up to 128 letters, ` + `digits, "_", "." and "-", and cannot start with "." or "-".`);
+var HEREDOC_INSTRUCTIONS = ["RUN", "COPY", "ADD"];
+function heredocs(keyword, rest, line, buildkit) {
+  while (keyword === "ONBUILD") {
+    const [, inner = "", innerRest = ""] = COMMAND.exec(trim(rest)) ?? [];
+    [keyword, rest] = [instructionOf(inner, line), innerRest];
+  }
+  if (!HEREDOC_INSTRUCTIONS.includes(keyword) || !rest.includes("<<"))
+    return [];
+  const body = rest.replace(/^(?:--\S+\s+)*/u, "").replace(TRIM_START, "");
+  if (body.startsWith("[")) {
+    const json = buildkit ? body : jsonPrefix(body);
+    try {
+      const array = json === undefined ? undefined : JSON.parse(json);
+      if (Array.isArray(array) && array.every((v) => typeof v === "string"))
+        return [];
+    } catch {}
   }
-  return `${repo}:${tag}`;
-}
-function encodeTagValue(value) {
-  assertAscii("placeholder value", value);
-  return value.replace(INVALID_TAG_CHARS, "-");
-}
-function encodeRepoValue(value) {
-  assertAscii("placeholder value", value);
-  if (/[^A-Za-z0-9._:/-]/u.test(value))
-    throw new CeError(`ce: ${JSON.stringify(value)} cannot go in an image name`);
-  return value;
-}
-function expandImage(template, vars) {
-  const image = expandValue(template, vars, encodeRepoValue, "image name");
-  if (!/^(?:[^/:]+:\d+\/)?[^:]*$/u.test(image)) {
-    throw new CeError(`ce: image name ${JSON.stringify(image)} from ${JSON.stringify(template)} has a ":" that is not a registry port`);
+  const unsure = () => fail(`ce cannot tell which heredocs the << on line ${line} starts`);
+  if (UNUSUAL_SPACE.test(rest) || !plainBraces(rest))
+    unsure();
+  const found = [];
+  let split;
+  try {
+    split = words(rest, "\\", true);
+  } catch {
+    return [];
   }
-  return image;
+  for (const word of split) {
+    const match = /^\d*<<(-?)[\t\n\f\r ]*([^<]*)$/u.exec(word);
+    if (!match?.[2])
+      continue;
+    const delimiter = /^(["']?)([^\s"'\\`$]+)\1$/u.exec(match[2]);
+    found.push({ name: delimiter?.[2] ?? unsure(), tabs: match[1] === "-" });
+  }
+  return found;
+}
+var PLAIN_BRACES = /\$\{[A-Za-z_][A-Za-z0-9_]*(?:(?::[-+?]|[-+?#%])[^\s"'\\`<${}]*)?\}/uy;
+var QUOTED_BRACES = /\$\{[A-Za-z_][A-Za-z0-9_]*(?:(?::[-+?]|[-+?#%])[^\n"'\\`<${}]*)?\}/uy;
+function plainBraces(text) {
+  let quote = "";
+  for (let i = 0;i < text.length; i++) {
+    const ch = text[i];
+    if (ch === "\\" && quote !== "'")
+      i++;
+    else if (quote && ch === quote)
+      quote = "";
+    else if (!quote && (ch === '"' || ch === "'"))
+      quote = ch;
+    else if (quote !== "'" && text.startsWith("${", i)) {
+      const braces = quote ? QUOTED_BRACES : PLAIN_BRACES;
+      braces.lastIndex = i;
+      const match = braces.exec(text);
+      if (!match)
+        return false;
+      i += match[0].length - 1;
+    }
+  }
+  return true;
+}
+function jsonPrefix(text) {
+  let depth = 0;
+  for (let i = 0;i < text.length; i++) {
+    const ch = text[i];
+    if (ch === '"') {
+      for (i++;i < text.length && text[i] !== '"'; i++)
+        if (text[i] === "\\")
+          i++;
+    } else if (ch === "[" || ch === "{")
+      depth++;
+    else if ((ch === "]" || ch === "}") && --depth === 0)
+      return text.slice(0, i + 1);
+  }
+  return;
+}
+var DIRECTIVE_SPACE = /[\t\n\f\r ]/u;
+function directive(text) {
+  const match = /^([a-zA-Z][a-zA-Z0-9]*)[\t\n\f\r ]*=[\t\n\f\r ]*([^\n]+)$/u.exec(trimEnd(text, DIRECTIVE_SPACE));
+  return match ? { key: match[1].toLowerCase(), value: match[2] } : undefined;
+}
+var DIRECTIVES = ["syntax", "escape", "check"];
+function detectSyntax(lines) {
+  if (lines[0]?.startsWith("#!"))
+    lines = lines.slice(1);
+  for (const prefix of ["#", "//"]) {
+    const seen = new Set;
+    for (const line of lines) {
+      if (!line.startsWith(prefix))
+        break;
+      const match = directive(line.slice(prefix.length).replace(TRIM_START, ""));
+      if (!match || !DIRECTIVES.includes(match.key) || seen.has(match.key))
+        break;
+      seen.add(match.key);
+      if (match.key === "syntax")
+        return match.value.split(" ")[0];
+    }
+  }
+  return;
 }
-function expandPrefix(prefix, vars, what) {
-  return hasPlaceholders(prefix) ? expandValue(prefix, vars, encodeTagValue, what) : prefix;
+function pair(word) {
+  const eq = word.indexOf("=");
+  return eq < 0 ? { name: word, value: undefined } : { name: word.slice(0, eq), value: word.slice(eq + 1) };
 }
-function literalRef(repo, tag) {
-  if (tag.includes("/")) {
-    const [first, rest] = splitOnce(tag, "/");
-    return `${repo}/${sanitizeChars(first, INVALID_TAG_CHARS)}:${sanitizeChars(rest, INVALID_TAG_CHARS)}`;
+function parseContainerfile(text, model = "buildkit") {
+  const buildkit = model === "buildkit";
+  const lines = text.replace(/^\ufeff/u, "").split(`
+`).map((line, at) => line.endsWith("\r\r") ? fail(`ce reads only LF and CRLF line ends, not line ${at + 1}'s`) : line.replace(/\r$/u, ""));
+  let escape = "\\";
+  let i = 0;
+  for (let seen = false;!buildkit && i < lines.length; i++) {
+    const directive = /^#[ \t]*escape[ \t]*=[ \t]*([^\n])/u.exec(lines[i].replace(TRIM_START, "").toLowerCase());
+    if (!directive)
+      break;
+    if (seen)
+      fail("there is more than one escape directive");
+    seen = true;
+    escape = directive[1];
+    if (escape !== "\\" && escape !== "`")
+      fail(`the escape directive ${JSON.stringify(escape)} is not \\ or \``);
+  }
+  for (const seen = new Set;buildkit && i < lines.length; i++) {
+    const line = lines[i].replace(TRIM_START, "");
+    const found = line.startsWith("#") ? directive(line.slice(1).replace(TRIM_START, "")) : undefined;
+    if (!found || !DIRECTIVES.includes(found.key) || seen.has(found.key))
+      break;
+    seen.add(found.key);
+    if (found.key === "escape") {
+      const { value } = found;
+      if (value !== "\\" && value !== "`")
+        fail(`the escape directive ${JSON.stringify(value)} is not \\ or \``);
+      escape = value;
+    }
   }
-  return `${repo}:${sanitizeChars(tag, INVALID_TAG_CHARS)}`;
-}
-function computeSafePrefix(prefix) {
-  assertAscii("tag prefix", prefix);
-  const p = sanitizeChars(prefix, INVALID_TAG_CHARS);
-  return p && !SEPARATORS.includes(p.at(-1)) ? `${p}-` : p;
-}
-function rewriteTagValue(value, tagPrefix, vars = new CiMetadata) {
-  assertAscii("tag", value);
-  const v = stripProto(value);
-  if (!v)
-    throw new CeError("ce: empty -t/--tag value");
-  const [repoTemplate, tagList] = splitRef(v) ?? [v, undefined];
-  if (hasPlaceholders(repoTemplate))
-    checkValue(repoTemplate, vars, "image name");
-  if (hasPlaceholders(tagPrefix))
-    checkValue(tagPrefix, vars, "tag prefix");
-  let repo;
-  const expandRepo = () => repo ??= hasPlaceholders(repoTemplate) ? expandImage(repoTemplate, vars) : repoTemplate;
-  if (tagList === undefined)
-    return [expandRepo()];
-  const tags = tagList.split(/[,\s]+/u).filter(Boolean);
-  if (!tags.length)
-    throw new CeError(`ce: no tag after the ":" in ${JSON.stringify(value)}`);
-  let safePrefix;
-  const refs = [];
-  for (const tag of tags) {
-    const expanded = hasPlaceholders(tag) ? expand(tag, vars, encodeTagValue) : tag;
-    if (expanded === null)
+  const e = escape === "\\" ? "\\\\" : escape;
+  const continued = buildkit ? new RegExp(`([^${e}])${e}[ \\t]*$|^${e}[ \\t]*$`, "u") : new RegExp(`()${e}[ \\t]*$`, "u");
+  const parsed = {
+    escape,
+    syntax: detectSyntax(lines),
+    globals: [],
+    stages: []
+  };
+  while (i < lines.length) {
+    let start = 0;
+    let line = "";
+    for (;i < lines.length; i++) {
+      const physical = lines[i];
+      if (/^(?:#|$)/u.test(trim(physical)))
+        continue;
+      start ||= i + 1;
+      if (continued.test(physical)) {
+        line += physical.replace(continued, "$1");
+        continue;
+      }
+      line += physical;
+      i++;
+      break;
+    }
+    line = trim(line);
+    if (!line)
       continue;
-    safePrefix ??= computeSafePrefix(expandPrefix(tagPrefix, vars, "tag prefix"));
-    if (hasPlaceholders(tag)) {
-      refs.push(assertValidTag(expandRepo(), `${safePrefix}${sanitizeChars(expanded, INVALID_TAG_CHARS)}`));
-    } else {
-      const ref = literalRef(expandRepo(), `${safePrefix}${tag}`);
-      const i = ref.lastIndexOf(":");
-      refs.push(assertValidTag(ref.slice(0, i), ref.slice(i + 1)));
+    const [instruction = "", rest = ""] = COMMAND.exec(line).slice(1);
+    const keyword = instructionOf(instruction, start);
+    for (const { name, tabs } of heredocs(keyword, rest, start, buildkit)) {
+      for (;; i++) {
+        if (i >= lines.length)
+          fail(`the heredoc ${name} from line ${start} never ends`);
+        const end = lines[i];
+        if ((tabs ? end.replace(/^\t+/u, "") : end) === name) {
+          i++;
+          break;
+        }
+      }
     }
-  }
-  return refs;
-}
-function csvFields(value) {
-  value = value.replace(/\r?\n$/u, "");
-  if (!value)
-    return null;
-  const fields = [];
-  let i = 0;
-  for (;; ) {
-    if (value[i] !== '"') {
-      const end = value.indexOf(",", i);
-      const field = end < 0 ? value.slice(i) : value.slice(i, end);
-      if (field.includes('"'))
-        return null;
-      fields.push(field);
-      if (end < 0)
-        return fields;
-      i = end + 1;
+    const [, onbuild = "", onbuildRest = ""] = keyword === "ONBUILD" ? COMMAND.exec(trim(rest)) ?? [] : [];
+    const kind = onbuild ? instructionOf(onbuild, start) : keyword;
+    const args = onbuild ? onbuildRest : rest;
+    if (keyword !== "FROM" && kind !== "ARG" && kind !== "ENV")
+      continue;
+    if (UNUSUAL_SPACE.test(line))
+      fail(`ce reads only ASCII space in the ${kind} on line ${start}`);
+    const split = onbuild && buildkit ? "\\" : escape;
+    const stage = parsed.stages.at(-1);
+    if (keyword === "FROM") {
+      const all = words(rest, buildkit ? escape : "\\");
+      let flags = 0;
+      while (all[flags]?.startsWith("--"))
+        if (all[flags++] === "--")
+          break;
+      const parts = all.slice(flags);
+      if (!(parts.length === 1 || parts.length === 3 && /^[Aa][Ss]$/u.test(parts[1])) || parts.some((part) => IS_SPACE.test(part)))
+        fail(`ce cannot read the FROM on line ${start}`);
+      parsed.stages.push({
+        name: parts[2] ?? "",
+        line: start,
+        base: parts[0],
+        instructions: []
+      });
       continue;
     }
-    let field = "";
-    for (i++;; i++) {
-      const quote = value.indexOf('"', i);
-      if (quote < 0)
-        return null;
-      field += value.slice(i, quote);
-      i = quote + 1;
-      if (value[i] !== '"')
-        break;
-      field += '"';
+    const set = words(args, split);
+    if (set[0]?.startsWith("--"))
+      fail(`ce does not read the flags of the ${kind} on line ${start}`);
+    const from = {
+      line: start,
+      ...onbuild !== "" && { onbuild: true }
+    };
+    if (kind === "ARG" && (stage || !onbuild)) {
+      if (!set.length)
+        fail(`the ARG on line ${start} names nothing`);
+      (stage?.instructions ?? parsed.globals).push({
+        kind: "ARG",
+        pairs: set.map(pair),
+        ...from
+      });
+    } else if (kind === "ENV" && stage) {
+      const legacy = set.length > 0 && !set[0].includes("=");
+      stage.instructions.push({
+        kind: "ENV",
+        pairs: legacy ? [{ name: set[0], value: undefined }] : set.map(pair),
+        ...from
+      });
     }
-    fields.push(field);
-    if (i === value.length)
-      return fields;
-    if (value[i] !== ",")
-      return null;
-    i++;
-  }
-}
-function csvJoin(fields) {
-  return fields.map((field) => /^[ \t]|[",\r\n]/u.test(field) ? `"${field.replaceAll('"', '""')}"` : field).join(",");
-}
-var fieldKey = (field) => field.split("=", 1)[0].toLowerCase();
-function ghaFields(value) {
-  const fields = csvFields(value);
-  const type = fields?.findLast((field) => fieldKey(field) === "type");
-  return type?.slice("type=".length) === "gha" ? fields : null;
-}
-var scopeIndex = (fields) => fields.findLastIndex((field) => fieldKey(field) === "scope");
-function cacheScopeName(value) {
-  const fields = ghaFields(value);
-  if (!fields)
-    return value;
-  const i = scopeIndex(fields);
-  if (i < 0)
-    return "";
-  const scope = fields[i].slice("scope=".length);
-  assertAscii("cache scope", scope);
-  return sanitizeChars(scope, INVALID_SCOPE_CHARS);
-}
-function normalizeCacheScope(value, cachePrefix) {
-  const fields = ghaFields(value);
-  if (!fields)
-    return value;
-  if (!cachePrefix)
-    return value;
-  assertAscii("cache prefix", cachePrefix);
-  const prefix = sanitizeChars(cachePrefix, INVALID_TAG_CHARS);
-  let scope = cacheScopeName(value);
-  if (!scope) {
-    scope = prefix.replace(/[-_.]+$/u, "");
-  } else if (prefix) {
-    scope = SEPARATORS.includes(prefix.at(-1)) ? `${prefix}${scope}` : `${prefix}-${scope}`;
   }
-  const i = scopeIndex(fields);
-  if (i < 0)
-    fields.push(`scope=${scope}`);
-  else
-    fields[i] = `scope=${scope}`;
-  return csvJoin(fields);
+  return parsed;
 }
 
-// src/build-args.ts
-function consumeValue(argv, flag) {
-  if (argv.length === 0)
-    throw new CeError(`ce: ${flag} requires a value but none was provided.`);
-  const v = argv[0];
-  if (v.length > 1 && v.startsWith("-")) {
-    throw new CeError(`ce: ${flag} requires a value but the next token ${JSON.stringify(v)} looks like a flag.`);
+class Unknown {
+  why;
+  reason;
+  constructor(why, reason = "") {
+    this.why = why;
+    this.reason = reason;
+  }
+}
+var BASE_ENV = new Unknown("base");
+var SCRATCH_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+var BUILTINS = [
+  "BUILDPLATFORM",
+  "BUILDOS",
+  "BUILDOSVERSION",
+  "BUILDARCH",
+  "BUILDVARIANT",
+  "TARGETPLATFORM",
+  "TARGETOS",
+  "TARGETOSVERSION",
+  "TARGETARCH",
+  "TARGETVARIANT",
+  "TARGETSTAGE"
+];
+var INJECTED = /^(?:SOURCE_DATE_EPOCH|(?:HTTPS?|FTP|NO|ALL)_PROXY)$/iu;
+var INJECTED_IB = /^SOURCE_DATE_EPOCH$/iu;
+var PROXIES = /^(?:(?:HTTPS?|FTP|NO)_PROXY|(?:https?|ftp|no)_proxy)$/u;
+var NON_ENV = ["BUILDKIT_SBOM_SCAN_CONTEXT", "BUILDKIT_SBOM_SCAN_STAGE"];
+function expandWord(word, escape, model, lookup) {
+  const buildkit = model === "buildkit";
+  let i = 0;
+  let depth = 0;
+  let unused = 0;
+  const value = (name) => {
+    if (unused)
+      return;
+    const v = lookup(name);
+    if (v instanceof Unknown) {
+      if (v.why !== "error") {
+        const exc = new Unreadable(`ce cannot tell what $${name} is there`);
+        exc.hint = v.reason;
+        throw exc;
+      }
+      const exc = new Unreadable(v.reason);
+      exc.located = true;
+      throw exc;
+    }
+    return v;
+  };
+  const readName = () => {
+    const rest = word.slice(i);
+    const name = (buildkit ? /^(?:[0-9]+|[@*#?\-$!]|[A-Za-z_][A-Za-z0-9_]*)/u.exec(rest)?.[0] : /^(?:[0-9]|[A-Za-z0-9_]+)/u.exec(rest)?.[0]) ?? "";
+    const after = rest.slice(name.length);
+    if (NON_ASCII.test(after[0] ?? "") && /^[\p{L}\p{Nd}]/u.test(after))
+      fail(`ce reads only ASCII names after a $, not in ${JSON.stringify(word)}`);
+    i += name.length;
+    return name;
+  };
+  const unsupported = () => fail(`ce does not evaluate the \${} in ${JSON.stringify(word)}`);
+  const dollar = () => {
+    i++;
+    if (word[i] !== "{") {
+      const name = readName();
+      return name ? value(name) ?? "" : "$";
+    }
+    i++;
+    const name = readName();
+    if (!name)
+      unsupported();
+    if (word[i] === "}") {
+      i++;
+      return value(name) ?? "";
+    }
+    const op = (buildkit ? /^:?[-+]/u : /^:[-+]/u).exec(word.slice(i))?.[0];
+    if (!op)
+      unsupported();
+    i += op.length;
+    const v = value(name);
+    const set = op.startsWith(":") ? v !== undefined && v !== "" : v !== undefined;
+    const used = op.endsWith("-") ? !set : set;
+    if (++depth > 100)
+      fail("ce does not evaluate ${} nested this deeply");
+    if (!used)
+      unused++;
+    const alternative = until("}");
+    if (!used)
+      unused--;
+    depth--;
+    return used ? alternative : set ? v : "";
+  };
+  const until = (end) => {
+    let out = "";
+    while (i < word.length) {
+      const ch = word[i];
+      if (end && ch === end) {
+        i++;
+        return out;
+      }
+      if (ch === escape) {
+        out += word[i + 1] ?? "";
+        i += 2;
+      } else if (ch === "'") {
+        const close = word.indexOf("'", i + 1);
+        if (close < 0)
+          fail(`unterminated ' in ${JSON.stringify(word)}`);
+        out += word.slice(i + 1, close);
+        i = close + 1;
+      } else if (ch === '"') {
+        i++;
+        for (;; ) {
+          if (i >= word.length)
+            fail(`unterminated " in ${JSON.stringify(word)}`);
+          const c = word[i];
+          if (c === '"') {
+            i++;
+            break;
+          }
+          if (c === escape && ['"', "$", escape].includes(word[i + 1] ?? "")) {
+            out += word[i + 1];
+            i += 2;
+          } else if (c === "$")
+            out += dollar();
+          else {
+            out += c;
+            i++;
+          }
+        }
+      } else if (ch === "$")
+        out += dollar();
+      else {
+        out += ch;
+        i++;
+      }
+    }
+    if (end)
+      fail(`missing ${end} in ${JSON.stringify(word)}`);
+    return out;
+  };
+  return until("");
+}
+var VARIANTS = new Map(Object.entries({
+  amd64: { "": "", v1: "", v2: "v2", v3: "v3", v4: "v4" },
+  arm64: { "": "", "8": "v8", v8: "v8", "v8.0": "v8" },
+  arm: {
+    "": "v7",
+    "5": "v5",
+    "6": "v6",
+    "7": "v7",
+    "8": "v8",
+    v5: "v5",
+    v6: "v6",
+    v7: "v7",
+    v8: "v8"
+  },
+  "386": { "": "" },
+  ppc64le: { "": "" },
+  riscv64: { "": "" },
+  s390x: { "": "" }
+}).map(([arch, variants]) => [arch, new Map(Object.entries(variants))]));
+var ARCH_NAMES = new Map([
+  ["aarch64", ["arm64"]],
+  ["x86_64", ["amd64"]],
+  ["x86-64", ["amd64"]],
+  ["i386", ["386", ""]],
+  ["armhf", ["arm", "v7"]],
+  ["armel", ["arm", "v6"]]
+]);
+function platformArgs(platform, model) {
+  const parts = platform.toLowerCase().split("/");
+  const isArch = (name) => VARIANTS.has(name) || ARCH_NAMES.has(name);
+  if (parts.length === 1 && isArch(parts[0]) && process.platform === "linux")
+    parts.unshift("linux");
+  const [os, written = "", given = "", ...rest] = parts;
+  if (os !== "linux" || rest.length)
+    return;
+  const [arch = written, fixed] = ARCH_NAMES.get(written) ?? [];
+  let variant = fixed === undefined ? VARIANTS.get(arch)?.get(given) : given ? undefined : fixed;
+  if (variant === undefined)
+    return;
+  if (arch === "arm64" && model === "buildkit")
+    variant = "";
+  return new Map([
+    ["TARGETPLATFORM", [os, arch, variant].filter(Boolean).join("/")],
+    ["TARGETOS", os],
+    ["TARGETARCH", arch],
+    ["TARGETVARIANT", variant],
+    ["TARGETOSVERSION", ""]
+  ]);
+}
+function normalizePlatform(platform, engine) {
+  return platformArgs(platform, engine === "docker" ? "buildkit" : "imagebuilder")?.get("TARGETPLATFORM");
+}
+function argDefault(parsed, name, target, buildArg, model = "buildkit", {
+  contexts = [],
+  envs = [],
+  env: hostEnv = process.env,
+  platform,
+  platformIgnored,
+  format,
+  from: fromImage
+} = {}) {
+  const buildkit = model === "buildkit";
+  const escape = buildkit ? parsed.escape : "\\";
+  const evaluate = (word, line, lookup) => {
+    try {
+      return expandWord(word, escape, model, lookup);
+    } catch (exc) {
+      if (!(exc instanceof Unreadable))
+        throw exc;
+      return new Unknown("error", exc.located ? exc.message : `${exc.message}, on line ${line}${exc.hint && `: ${exc.hint}`}`);
+    }
+  };
+  const isBuiltin = (arg) => BUILTINS.includes(arg);
+  let targets;
+  const builtin = (arg, global) => {
+    if (arg.startsWith("BUILD"))
+      return new Unknown("builtin", "it is the platform of the machine that builds");
+    if (arg === "TARGETSTAGE")
+      return new Unknown("builtin");
+    if (global && !buildkit)
+      return new Unknown("builtin", "podman and buildah do not set it from --platform before the first FROM");
+    targets ??= platformIgnored?.() ?? (platform === undefined ? "it comes from --platform, which the build does not have" : platformArgs(platform, model) ?? `ce does not read the --platform ${JSON.stringify(platform)}`);
+    return typeof targets === "string" ? new Unknown("builtin", targets) : targets.get(arg);
+  };
+  const injected = (arg) => (buildkit ? INJECTED : INJECTED_IB).test(arg);
+  const plain = (name) => ![...`$'"`, escape].some((ch) => name.includes(ch));
+  const named = (kind, name, line) => plain(name) ? name : fail(`ce cannot tell what name the ${kind} on line ${line} sets`);
+  const globals = new Map;
+  for (const arg of BUILTINS)
+    globals.set(arg, buildArg(arg) ?? builtin(arg, true));
+  for (const { pairs, line } of parsed.globals) {
+    const before = new Map(globals);
+    const seen = (ref) => {
+      const known = buildkit ? globals : before;
+      if (known.has(ref) || buildkit || !PROXIES.test(ref))
+        return known.get(ref);
+      return buildArg(ref);
+    };
+    for (const { name, value } of pairs) {
+      const arg = named("ARG", name, line);
+      const given = buildArg(arg);
+      if (given !== undefined)
+        globals.set(arg, given);
+      else if (injected(arg))
+        globals.set(arg, new Unknown("injected"));
+      else if (value !== undefined && !(isBuiltin(arg) && !buildkit))
+        globals.set(arg, evaluate(value, line, seen));
+    }
   }
-  return [v, argv.slice(1)];
-}
-var SUMMARIZED = {
-  "-f": "dockerfile",
-  "--file": "dockerfile",
-  "--target": "target",
-  "--platform": "platform",
-  "--build-arg": "buildArgs",
-  "--label": "labels"
-};
-function parseBuildArgs(argv, tagPrefix, cachePrefix, { vars = new CiMetadata, labels = {} } = {}) {
-  const args = [];
-  const rawCacheFrom = [];
-  const rawCacheTo = [];
-  const summary = {
-    tags: [],
-    cacheFrom: [],
-    cacheTo: [],
-    buildArgs: [],
-    labels: [],
-    dockerfile: "",
-    target: "",
-    platform: "",
-    context: ""
+  const findStage = (wanted, before, target = false) => {
+    const at = parsed.stages.findLastIndex((s, i) => i < before && (buildkit ? stageKey(s.name) === stageKey(wanted) : (s.name || String(i)) === wanted || !target && String(i) === wanted));
+    if (at >= 0 || buildkit || !target || !/^\d+$/u.test(wanted))
+      return at;
+    const position = Number(wanted);
+    return position < before ? position : -1;
   };
-  let templated = false;
-  let rest = [];
-  const addTags = (value, flag) => {
-    templated ||= hasPlaceholders(value);
-    const refs = rewriteTagValue(value, tagPrefix, vars);
-    for (const ref of refs)
-      args.push(`${flag}${ref}`);
-    summary.tags.push(...refs);
+  const replaced = (index) => {
+    const stage = parsed.stages[index].name;
+    return buildkit && stage ? contexts.find((c) => stageKey(familiar(c)) === stageKey(stage)) : undefined;
   };
-  const summarize = (flag, value) => {
-    const field = SUMMARIZED[flag];
-    if (field === "buildArgs" || field === "labels")
-      summary[field].push(value);
-    else
-      summary[field] = value;
+  for (const stage of parsed.stages) {
+    if (!buildkit && !plain(stage.name))
+      fail(`ce cannot tell what the stage ${JSON.stringify(stage.name)} is named`);
+  }
+  const source = (index) => {
+    const stage = parsed.stages[index];
+    const base = index === 0 && fromImage !== undefined && !buildkit ? fromImage : evaluate(stage.base, stage.line, (ref) => globals.get(ref));
+    let parent = typeof base === "string" ? findStage(base, index) : -1;
+    const swapped = buildkit ? parent >= 0 ? replaced(parent) : undefined : contexts.find((c) => c === stage.base || c === base);
+    if (swapped !== undefined)
+      parent = -1;
+    return { base, parent, swapped };
   };
-  for (let i = 0;i < argv.length; i++) {
-    const arg = argv[i];
-    const [name, attached] = arg.startsWith("--") && arg.includes("=") ? splitAt(arg, "=") : [arg, undefined];
-    const next = () => consumeValue(argv.slice(++i), arg)[0];
-    if (arg === "--") {
-      rest = argv.slice(i);
-      if (rest.length > 1)
-        summary.context = rest.at(-1);
-      break;
-    } else if (arg === "-t")
-      addTags(next(), "-t");
-    else if (arg === "--tag")
-      addTags(next(), "--tag=");
-    else if (arg.startsWith("-t"))
-      addTags(arg.slice(2), "-t");
-    else if (name === "--tag")
-      addTags(attached, "--tag=");
-    else if (name === "--cache-from")
-      rawCacheFrom.push(attached ?? next());
-    else if (name === "--cache-to")
-      rawCacheTo.push(attached ?? next());
-    else if (name === "--cache") {
-      const v = attached ?? next();
-      rawCacheFrom.push(v);
-      rawCacheTo.push(v);
-    } else if (Object.hasOwn(SUMMARIZED, name)) {
-      const flag = name;
-      if (attached === undefined) {
-        const v = next();
-        args.push(arg, v);
-        summarize(flag, v);
-      } else {
-        args.push(arg);
-        summarize(flag, attached);
+  const states = new Map;
+  const run = (index) => {
+    const known = states.get(index);
+    if (known)
+      return known;
+    const stage = parsed.stages[index];
+    const { base, parent, swapped } = source(index);
+    const from = parent >= 0 ? run(parent) : undefined;
+    const state = {
+      env: new Map,
+      args: new Map,
+      image: new Map(from?.image),
+      opaque: from?.opaque ?? (swapped !== undefined || base !== "scratch")
+    };
+    const lost = (name) => new Unknown("error", `--build-context ${name} replaces what the FROM on line ${stage.line} builds from, so ce cannot tell what it sets`);
+    let triggers = [];
+    if (buildkit) {
+      if (base instanceof Unknown)
+        state.undeclared = new Unknown("error", `ce cannot tell what the FROM on line ${stage.line} is built from: ${base.reason}`);
+      else if (swapped !== undefined)
+        state.undeclared = lost(swapped);
+      else if (from) {
+        state.args = new Map(from.args);
+        state.undeclared = from.undeclared;
+        for (const [k, v] of from.env)
+          state.env.set(k, from.opaque ? BASE_ENV : k === "PATH" ? SCRATCH_PATH : v);
+        for (const [k, v] of from.image)
+          state.env.set(k, v);
+        triggers = parsed.stages[parent].instructions.filter((i) => i.onbuild);
       }
-    } else if (arg.startsWith("-f") && arg.length > 2) {
-      args.push(arg);
-      summary.dockerfile = arg.slice(2);
     } else {
-      args.push(arg);
-      if (!arg.startsWith("-"))
-        summary.context = arg;
+      if (from)
+        state.env = new Map(from.env);
+      const unset = envs.filter((flag) => flag.startsWith("--unsetenv "));
+      for (const flag of unset) {
+        const spec = flag.slice(flag.indexOf(" ") + 1);
+        if (/["\r\n]/u.test(spec))
+          for (const k of state.env.keys())
+            state.env.set(k, new Unknown("error", `${k} may be changed by ${/[\r\n]/u.test(spec) ? `--unsetenv ${JSON.stringify(spec)}` : flag}`));
+        else
+          for (const k of spec.split(","))
+            state.env.delete(k);
+      }
+      for (const flag of envs.filter((f) => f.startsWith("--env "))) {
+        const spec = flag.slice(flag.indexOf(" ") + 1);
+        const copied = (k, v) => {
+          const what = v.includes("$") ? "expand the $" : engineEscapes(v) ? "escape the characters podman and buildah escape" : undefined;
+          if (what === undefined)
+            return v;
+          return new Unknown("error", spec.includes("=") ? `ce does not ${what} in --env ${engineEscapes(spec) ? JSON.stringify(spec) : spec}` : `ce does not ${what} in the ${k} that ${flag} copies`);
+        };
+        if (spec.includes("=")) {
+          const k = spec.slice(0, spec.indexOf("="));
+          state.env.set(k, copied(k, spec.slice(k.length + 1)));
+        } else if (spec.endsWith("*") && !spec.slice(0, -1).includes("*")) {
+          for (const [k, v] of Object.entries(hostEnv))
+            if (k.startsWith(spec.slice(0, -1)) && v !== undefined)
+              state.env.set(k, copied(k, v));
+        } else if (spec.includes("*"))
+          fail(`ce does not read ${flag}`);
+        else if (!spec.endsWith("-") && hostEnv[spec] !== undefined)
+          state.env.set(spec, copied(spec, hostEnv[spec]));
+      }
+      const written = findStage(stage.base, index);
+      if (swapped !== undefined)
+        state.undeclared = lost(swapped);
+      else if (written >= 0)
+        state.args = inheritedArgs(written);
+      const onbuilds = parent >= 0 ? parsed.stages[parent].instructions.filter((i) => i.onbuild) : [];
+      if (format === "docker")
+        triggers = onbuilds;
+      for (const { kind, pairs, line } of format ? [] : onbuilds) {
+        for (const { name: arg } of pairs) {
+          if (!plain(arg))
+            fail(`ce cannot tell what name the ONBUILD on line ${line} sets`);
+          (kind === "ENV" ? state.env : state.args).set(arg, new Unknown("error", `${arg} may be set by the ONBUILD on line ${line}, which ${model} runs only for some image formats`));
+        }
+      }
     }
+    const see = (env, args) => (ref) => env.has(ref) ? env.get(ref) : state.opaque ? BASE_ENV : ref === "PATH" ? SCRATCH_PATH : buildkit ? undefined : args.has(ref) ? args.get(ref) : PROXIES.test(ref) ? buildArg(ref) : undefined;
+    const own = stage.instructions.filter((i) => !i.onbuild);
+    for (const { kind, pairs, line } of [...triggers, ...own]) {
+      const before = new Map(state.env);
+      const argsBefore = new Map(state.args);
+      for (const { name, value } of pairs) {
+        const arg = named(kind, name, line);
+        const seen = buildkit && kind === "ARG" ? state.env : before;
+        const evaluated = (word) => evaluate(word, line, see(seen, argsBefore));
+        if (kind === "ENV") {
+          const v = value === undefined ? new Unknown("error", `ce does not read the ENV ${arg} on line ${line}`) : evaluated(value);
+          state.env.set(arg, v);
+          state.image.set(arg, v);
+          continue;
+        }
+        const given = buildArg(arg);
+        let v;
+        if (given !== undefined)
+          v = given;
+        else if (injected(arg))
+          v = new Unknown("injected");
+        else if (isBuiltin(arg) && (!buildkit || value === undefined))
+          v = buildkit ? globals.get(arg) : builtin(arg, false);
+        else if (value !== undefined)
+          v = evaluated(value);
+        else if (globals.get(arg) !== undefined)
+          v = globals.get(arg);
+        else {
+          if (!state.args.has(arg))
+            state.args.set(arg, state.undeclared);
+          continue;
+        }
+        state.args.set(arg, v);
+        if (buildkit && !NON_ENV.includes(arg))
+          state.env.set(arg, v);
+      }
+    }
+    states.set(index, state);
+    return state;
+  };
+  const inherited = new Map;
+  const inheritedArgs = (index) => {
+    const todo = [];
+    let i = index;
+    while (i >= 0 && !inherited.has(i)) {
+      todo.unshift(i);
+      i = findStage(parsed.stages[i].base, i);
+    }
+    let args = new Map(inherited.get(i));
+    for (const at of todo) {
+      for (const { kind, pairs, line, onbuild } of parsed.stages[at].instructions) {
+        if (kind !== "ARG" || onbuild)
+          continue;
+        for (const { name: arg, value } of pairs) {
+          named("ARG", arg, line);
+          const given = buildArg(arg);
+          if (given !== undefined)
+            args.set(arg, given);
+          else if (injected(arg))
+            args.set(arg, new Unknown("injected"));
+          else if (isBuiltin(arg))
+            args.set(arg, globals.get(arg));
+          else if (value?.includes("$"))
+            args.set(arg, new Unknown("error", `ce does not work out the $ in the ARG ${arg} on line ${line}, which a stage built from it gets`));
+          else if (value !== undefined)
+            args.set(arg, evaluate(value, line, () => {
+              return;
+            }));
+          else if (globals.get(arg) !== undefined)
+            args.set(arg, globals.get(arg));
+          else if (!args.has(arg))
+            args.set(arg, undefined);
+        }
+      }
+      inherited.set(at, args);
+      args = new Map(args);
+    }
+    return args;
+  };
+  let index = parsed.stages.length - 1;
+  if (index < 0)
+    fail("it has no FROM");
+  if (target) {
+    index = findStage(target, parsed.stages.length, true);
+    if (index < 0)
+      fail(`it has no stage named ${JSON.stringify(target)}`);
+  }
+  const swapped = replaced(index);
+  if (swapped !== undefined)
+    fail(`--build-context ${swapped} replaces the stage built`);
+  const ancestors = [];
+  for (let i = index;i >= 0; i = source(i).parent)
+    ancestors.unshift(i);
+  for (const i of ancestors)
+    run(i);
+  const state = run(index);
+  const v = state.args.has(name) ? state.args.get(name) : state.undeclared ?? (!globals.has(name) && injected(name) && buildArg(name) === undefined ? new Unknown("injected") : globals.get(name));
+  if (v instanceof Unknown) {
+    if (v.why === "builtin")
+      fail(`${name} is set by the builder${v.reason && `: ${v.reason}`}`);
+    if (v.why === "injected")
+      fail(`${name} may be set by the builder`);
+    fail(v.why === "error" ? v.reason : `ce cannot tell what ${name} is`);
+  }
+  return v;
+}
+function readContainerfile(file, model) {
+  let text;
+  try {
+    text = fs5.readFileSync(file, "utf8");
+  } catch (exc) {
+    return fail(`ce cannot read ${JSON.stringify(file)}: ${errorMessage(exc)}`);
   }
-  if (templated && !summary.tags.length) {
-    throw new CeError("ce: the guards in the -t templates left out every tag, so the image would have none");
-  }
-  const ownKeys = new Set(summary.labels.map((label) => label.split("=", 1)[0]));
-  const added = Object.entries(labels).filter(([key]) => !ownKeys.has(key)).map(([key, value]) => `${key}=${value}`);
-  args.unshift(...added.map((label) => `--label=${label}`));
-  summary.labels.unshift(...added);
-  if (rawCacheFrom.length || rawCacheTo.length)
-    cachePrefix = expandPrefix(cachePrefix, vars, "cache prefix");
-  const toNames = new Set(rawCacheTo.map(cacheScopeName));
-  for (const c of rawCacheFrom) {
-    const rewritten = toNames.has(cacheScopeName(c)) ? normalizeCacheScope(c, cachePrefix) : c;
-    args.push(`--cache-from=${rewritten}`);
-    summary.cacheFrom.push(rewritten);
+  try {
+    return parseContainerfile(text, model);
+  } catch (exc) {
+    if (exc instanceof Unreadable)
+      fail(`${JSON.stringify(file)}: ${exc.message}`);
+    throw exc;
   }
-  for (const c of rawCacheTo) {
-    const rewritten = normalizeCacheScope(c, cachePrefix);
-    args.push(`--cache-to=${rewritten}`);
-    summary.cacheTo.push(rewritten);
+}
+function loadContainerfile(files, buildArg) {
+  const docker = files.engine === "docker";
+  let file;
+  let parsed;
+  try {
+    file = findContainerfile(files);
+    parsed = readContainerfile(file, docker ? "buildkit" : "imagebuilder");
+  } catch (exc) {
+    if (exc instanceof Unreadable)
+      return { error: exc };
+    throw exc;
   }
-  args.push(...rest);
-  return { args, summary };
+  const frontend = docker ? buildArg("BUILDKIT_SYNTAX")?.trim().split(" ")[0] ?? parsed.syntax : undefined;
+  if (frontend !== undefined && !STANDARD_SYNTAX.test(frontend))
+    return {
+      file,
+      error: new Unreadable(`it is read by the frontend ${JSON.stringify(frontend)}, which may read it differently`)
+    };
+  return { file, parsed };
 }
-function splitAt(value, sep) {
-  const i = value.indexOf(sep);
-  return [value.slice(0, i), value.slice(i + 1)];
-}
-function printBuildSummary(engine, args, summary) {
-  const command = findBuildCommand(engine, args);
-  if (!command || command.tagsOnly)
+function dockerfileEpoch(files, buildArg) {
+  let read;
+  try {
+    read = loadContainerfile(files, buildArg);
+  } catch {
+    return "";
+  }
+  if (!read.parsed)
+    return "";
+  const defaults = read.parsed.globals.flatMap(({ pairs }) => pairs).filter(({ name, value }) => name === "SOURCE_DATE_EPOCH" && value !== undefined);
+  if (!defaults.length)
     return;
-  const subcommand = command.name;
-  const out = ["[ce] build summary:", `  engine: ${engine}`, `  subcommand: ${subcommand}`];
-  const list = (title, items) => {
-    if (items.length)
-      out.push(`  ${title}:`, ...items.map((item) => `    - ${item}`));
+  const value = defaults[0].value;
+  return defaults.length === 1 && !value.includes("$") ? value : "";
+}
+function containerfileDefaults(files, buildArg) {
+  const model = files.engine === "docker" ? "buildkit" : "imagebuilder";
+  let read;
+  const load = () => loadContainerfile(files, buildArg);
+  const platforms = files.platforms?.length ? [...new Set(files.platforms)] : [undefined];
+  return (name) => {
+    read ??= load();
+    try {
+      if (read.error)
+        throw read.error;
+      const values = platforms.map((platform) => argDefault(read.parsed, name, files.target, buildArg, model, {
+        contexts: files.contexts ?? [],
+        envs: files.envs ?? [],
+        env: files.env ?? process.env,
+        platform,
+        platformIgnored: files.platformIgnored,
+        format: files.format,
+        from: files.from
+      }));
+      const other = values.findIndex((v) => (v ?? "") !== (values[0] ?? ""));
+      if (other !== -1)
+        fail(`it is ${JSON.stringify(values[0] ?? "")} for ${platforms[0]} but ${JSON.stringify(values[other] ?? "")} for ${platforms[other]}, and every platform gets the same tags`);
+      return values[0];
+    } catch (exc) {
+      if (!(exc instanceof Unreadable))
+        throw exc;
+      const where = read.file ? ` from ${JSON.stringify(read.file)}` : "";
+      throw new CeError(`ce: {arg.${name}} has no value from --build-arg, and ce cannot work out its default${where}: ${exc.message}`);
+    }
   };
-  list("tags", summary.tags);
-  list("cache-from", summary.cacheFrom);
-  list("cache-to", summary.cacheTo);
-  if (summary.dockerfile)
-    out.push(`  dockerfile: ${summary.dockerfile}`);
-  if (summary.target)
-    out.push(`  target: ${summary.target}`);
-  if (summary.platform)
-    out.push(`  platform: ${summary.platform}`);
-  list("build args", summary.buildArgs);
-  list("labels", summary.labels);
-  if (summary.context)
-    out.push(`  context: ${summary.context}`);
-  io.stderr(`${out.join(`
-`)}
+}
 
-`);
+// src/version.ts
+var SEMVER = /^v?((0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?)$/u;
+
+// src/metadata.ts
+var CI_VARIABLES = [
+  "image",
+  "ref",
+  "branch",
+  "pr",
+  "tag",
+  "default",
+  "revision",
+  "sha",
+  "version",
+  "major",
+  "minor",
+  "patch",
+  "stable"
+];
+var ENV_VARIABLE = /^env\.([A-Za-z_][A-Za-z0-9_]*)$/u;
+var nonEmpty = (value) => value ? value : undefined;
+function epochDate(epoch, base = 10) {
+  const match = base === 10 ? /^([+-]?)(\d+)$/u.exec(epoch) : /^([+-]?)(0[xX][0-9a-fA-F]+|0[oO][0-7]+|0[bB][01]+|0[0-7]+|0|[1-9]\d*)$/u.exec(epoch);
+  if (!match)
+    return;
+  const digits = match[2];
+  const magnitude = base === 0 && /^0[0-7]/u.test(digits) ? BigInt(`0o${digits.slice(1)}`) : BigInt(digits);
+  const seconds = match[1] === "-" ? -magnitude : magnitude;
+  if (seconds < -(2n ** 63n) || seconds >= 2n ** 63n)
+    return;
+  const date = new Date(Number(seconds) * 1000);
+  return Number.isNaN(date.getTime()) ? undefined : date;
 }
+var rfc3339 = (date) => date.toISOString().replace(/\.\d{3}Z$/u, "Z");
 
-// src/oidc.ts
-var REFRESH_WINDOW_S = 5 * 60;
-var REQUEST_TIMEOUT_MS = 30000;
-var decodeUtf8 = (bytes) => new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-async function forgejoOidcJwt(audience, requestUrl, requestToken) {
-  assertAbsoluteHttpUrl(requestUrl, "token request URL must be an absolute HTTP(S) URL");
-  let tokenUrl;
-  let headers;
-  try {
-    const url = new URL(requestUrl);
-    if (url.username || url.password)
-      throw new Error("credentials in URL");
-    url.searchParams.set("audience", audience);
-    tokenUrl = url.href;
-    headers = { Accept: "application/json", Authorization: `bearer ${requestToken}` };
-    new Headers(headers);
-  } catch {
-    throw new CeError("token request URL or headers are invalid");
+class CiMetadata {
+  #env;
+  #cache = new Map;
+  #ref;
+  #event;
+  constructor(env = process.env) {
+    this.#env = env;
   }
-  let body;
-  try {
-    const response = await fetch(tokenUrl, { headers, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
-    if (!response.ok)
-      throw new Error(`HTTP ${response.status} ${response.statusText}`);
-    body = await response.arrayBuffer();
-  } catch (exc) {
-    throw new CeError(`token request failed: ${errorMessage(exc)}`);
+  known(name) {
+    return CI_VARIABLES.includes(name) || ENV_VARIABLE.test(name);
   }
-  let payload;
-  try {
-    payload = JSON.parse(decodeUtf8(body));
-  } catch {
-    throw new CeError("token response is not valid UTF-8 JSON");
+  get(name) {
+    const envName = ENV_VARIABLE.exec(name)?.[1];
+    if (envName)
+      return Object.hasOwn(this.#env, envName) ? nonEmpty(this.#env[envName]) : undefined;
+    if (!this.#cache.has(name))
+      this.#cache.set(name, this.#resolve(name));
+    return this.#cache.get(name);
   }
-  if (!isObject(payload))
-    throw new CeError("token response is not a JSON object");
-  const jwt = payload.value;
-  if (typeof jwt !== "string" || !jwt.trim()) {
-    throw new CeError("token response has no non-empty string 'value'");
+  labels(now = new Date) {
+    const labels = {};
+    const add = (key, value) => {
+      try {
+        const v = value();
+        if (v)
+          labels[`org.opencontainers.image.${key}`] = v;
+      } catch (exc) {
+        if (!(exc instanceof CeError))
+          throw exc;
+      }
+    };
+    const server = nonEmpty(this.#ciEnv("SERVER_URL"))?.replace(/\/+$/u, "");
+    const repository = nonEmpty(this.#ciEnv("REPOSITORY"));
+    const page = server && repository ? `${server}/${repository}` : undefined;
+    const repo = (key) => {
+      const value = this.#payload().repository;
+      return isObject(value) && typeof value[key] === "string" ? value[key] : undefined;
+    };
+    add("source", () => page);
+    add("url", () => {
+      try {
+        return repo("website") || page;
+      } catch (exc) {
+        if (exc instanceof CeError)
+          return page;
+        throw exc;
+      }
+    });
+    add("revision", () => this.#ciEnv("SHA"));
+    add("version", () => this.get("version") ?? this.#rawRef());
+    add("title", () => repository?.split("/").at(-1));
+    add("description", () => repo("description"));
+    const epoch = this.#env.SOURCE_DATE_EPOCH;
+    const time = epoch ? epochDate(epoch) : now;
+    if (Object.keys(labels).length && time)
+      add("created", () => rfc3339(time));
+    return labels;
   }
-  return jwt.trim();
-}
-function jwtExpiry(jwt) {
-  const parts = jwt.split(".");
-  if (parts.length !== 3)
-    throw new CeError("OIDC token is not a three-part JWT");
-  let payload;
-  try {
-    payload = JSON.parse(decodeUtf8(Buffer.from(parts[1], "base64url")));
-  } catch {
-    throw new CeError("OIDC token has an invalid JWT payload");
+  #resolve(name) {
+    switch (name) {
+      case "image": {
+        const server = this.#require("SERVER_URL", "{image}");
+        const repository = this.#require("REPOSITORY", "{image}");
+        return `${registryServer(server)}/${repository}`.toLowerCase();
+      }
+      case "ref":
+        return this.#rawRef();
+      case "branch": {
+        const ref = this.#parsedRef();
+        return ref.kind === "branch" ? ref.name : undefined;
+      }
+      case "tag": {
+        const ref = this.#parsedRef();
+        return ref.kind === "tag" ? ref.name : undefined;
+      }
+      case "pr": {
+        const ref = this.#parsedRef();
+        return ref.kind === "pr" ? ref.number : undefined;
+      }
+      case "default": {
+        const ref = this.#parsedRef();
+        if (ref.kind !== "branch")
+          return;
+        return ref.name === this.defaultBranch() ? ref.name : undefined;
+      }
+      case "revision":
+        return this.#require("SHA", `{${name}}`);
+      case "sha":
+        return this.#require("SHA", `{${name}}`).slice(0, 7);
+      case "version":
+        return this.#semver()?.[1];
+      case "major":
+        return this.#semver()?.[2];
+      case "minor":
+        return this.#semver()?.[3];
+      case "patch":
+        return this.#semver()?.[4];
+      case "stable": {
+        const semver = this.#semver();
+        return semver && semver[5] === undefined ? semver[1] : undefined;
+      }
+    }
+    throw new CeError(`ce: unknown placeholder {${name}}`);
+  }
+  #ciEnv(name) {
+    return nonEmpty(this.#env[`FORGEJO_${name}`]) ?? nonEmpty(this.#env[`GITHUB_${name}`]);
+  }
+  #require(name, user) {
+    const value = this.#ciEnv(name);
+    if (!value) {
+      throw new CeError(`ce: ${user} needs GITHUB_${name} (or FORGEJO_${name}), which is not set; is this a Forgejo Actions run?`);
+    }
+    return value;
+  }
+  #rawRef() {
+    const ref = this.#parsedRef();
+    return ref.kind === "pr" ? `pr-${ref.number}` : ref.name;
+  }
+  #parsedRef() {
+    if (this.#ref)
+      return this.#ref;
+    const ref = this.#require("REF", "{ref}, {branch}, {tag} or {pr}");
+    const event = this.#ciEnv("EVENT_NAME") ?? "";
+    const pull = /^refs\/pull\/(\d+)\//u.exec(ref);
+    if (event.startsWith("pull_request") || pull) {
+      const payload = pull ? {} : this.#payload();
+      const fromPayload = [
+        isObject(payload.pull_request) && payload.pull_request.number,
+        payload.number
+      ].find(Number.isInteger);
+      const number = pull?.[1] ?? (fromPayload === undefined ? undefined : String(fromPayload));
+      if (!number)
+        throw new CeError(`ce: cannot find the pull request number for ${event} on ${ref}`);
+      this.#ref = { kind: "pr", number };
+    } else if (ref.startsWith("refs/heads/")) {
+      this.#ref = { kind: "branch", name: ref.slice("refs/heads/".length) };
+    } else if (ref.startsWith("refs/tags/")) {
+      this.#ref = { kind: "tag", name: ref.slice("refs/tags/".length) };
+    } else {
+      throw new CeError(`ce: cannot tell what ${JSON.stringify(ref)} is: not a branch, tag or pull request`);
+    }
+    return this.#ref;
+  }
+  #semver() {
+    const ref = this.#parsedRef();
+    return ref.kind === "tag" ? SEMVER.exec(ref.name) : null;
+  }
+  defaultBranch() {
+    const repository = this.#ciEnv("EVENT_PATH") ? this.#payload().repository : undefined;
+    const fromEvent = isObject(repository) ? repository.default_branch : undefined;
+    const branch = typeof fromEvent === "string" && fromEvent || nonEmpty(this.#env.DEFAULT_BRANCH);
+    if (!branch) {
+      throw new CeError("ce: {default} needs repository.default_branch in the event file or DEFAULT_BRANCH, and neither is set");
+    }
+    return branch;
+  }
+  #payload() {
+    if (this.#event)
+      return this.#event;
+    const file = this.#require("EVENT_PATH", "reading the event file");
+    let payload;
+    try {
+      payload = readJsonFile(file, undefined);
+    } catch (exc) {
+      throw new CeError(`ce: ${errorMessage(exc)}`);
+    }
+    if (!isObject(payload))
+      throw new CeError(`ce: the event file ${JSON.stringify(file)} is missing or not a JSON object`);
+    this.#event = payload;
+    return payload;
   }
-  const expiry = isObject(payload) ? payload.exp : undefined;
-  if (typeof expiry !== "number")
-    throw new CeError("OIDC token has no numeric 'exp' claim");
-  return expiry;
 }
-function needsRefresh(expiry) {
-  return expiry <= Date.now() / 1000 + REFRESH_WINDOW_S;
+var ON_DEFAULT_BRANCH = new Set(["ref", "branch", "default"]);
+var UNKNOWN_ON_DEFAULT_BRANCH = new Set(["revision", "sha"]);
+function onDefaultBranch(vars, branch) {
+  return {
+    known: (name) => vars.known(name),
+    get(name) {
+      if (ON_DEFAULT_BRANCH.has(name))
+        return branch;
+      if (UNKNOWN_ON_DEFAULT_BRANCH.has(name)) {
+        throw new CeError(`ce: the default branch's cache scope cannot use {${name}}: this run does not know its commit`);
+      }
+      return name === "image" || name.startsWith("env.") ? vars.get(name) : undefined;
+    }
+  };
 }
 
-// src/state.ts
-import fs4 from "node:fs";
-import { homedir } from "node:os";
-import path3 from "node:path";
+// src/tag-lists.ts
+var NAME = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+var REFERENCE = /^\{tags\.([A-Za-z_][A-Za-z0-9_]*)\}$/u;
+function defineTagList(spec, lists) {
+  const eq = spec.indexOf("=");
+  const name = eq < 0 ? spec : spec.slice(0, eq);
+  if (eq < 0 || !NAME.test(name))
+    throw new CeError("ce: --tag-list requires NAME=TEMPLATES, with an identifier as NAME");
+  const template = spec.slice(eq + 1);
+  if (!splitTagTemplates(template).length)
+    throw new CeError(`ce: --tag-list ${name} has no tags`);
+  if (lists.has(name))
+    throw new CeError(`ce: --tag-list ${name} is defined more than once`);
+  lists.set(name, template);
+}
+function splitTagTemplates(value) {
+  return value.match(/(?:\{[^{}]*\}|[^,\s{}]|[{}])+/gu) ?? [];
+}
+function expandTagLists(value, lists) {
+  const tags = [];
+  const active = new Set;
+  const stack = [{ name: "", tags: splitTagTemplates(value), index: 0 }];
+  while (stack.length) {
+    const frame = stack.at(-1);
+    if (frame.index === frame.tags.length) {
+      active.delete(frame.name);
+      stack.pop();
+      continue;
+    }
+    const tag = frame.tags[frame.index++];
+    const name = REFERENCE.exec(tag)?.[1];
+    if (name === undefined) {
+      if (tag.includes("{tags."))
+        throw new CeError(`ce: a {tags.NAME} reference must be a whole tag-list entry: ${JSON.stringify(tag)}`);
+      tags.push(tag);
+      continue;
+    }
+    const template = lists.get(name);
+    if (template === undefined)
+      throw new CeError(`ce: unknown tag list ${JSON.stringify(name)}; define it with --tag-list`);
+    if (active.has(name))
+      throw new CeError(`ce: cyclic tag list reference: ${[...active, name].join(" -> ")}`);
+    active.add(name);
+    stack.push({ name, tags: splitTagTemplates(template), index: 0 });
+  }
+  return tags;
+}
 
-// src/lock.ts
-import fs3 from "node:fs";
-import { hostname } from "node:os";
-import { setTimeout as setTimeout2 } from "node:timers/promises";
-var STALE_AFTER_MS = 120000;
-var POLL_MS = 50;
-function snapshot(lockPath) {
-  try {
-    const { ino, mtimeMs } = fs3.statSync(lockPath);
-    return { ino, mtimeMs, owner: fs3.readFileSync(lockPath, "utf8").trim() };
-  } catch (exc) {
-    if (isErrno(exc, "ENOENT"))
-      return null;
-    throw exc;
+// src/template.ts
+var PLACEHOLDER = /\{([^{}]*)\}/gu;
+function hasPlaceholders(value) {
+  return value.includes("{") || value.includes("}");
+}
+function parse(template, vars) {
+  const parts = [];
+  const text = (value) => {
+    if (hasPlaceholders(value))
+      throw new CeError(`ce: unmatched brace in ${JSON.stringify(template)}`);
+    if (value)
+      parts.push({ text: value });
+  };
+  let last = 0;
+  for (const match of template.matchAll(PLACEHOLDER)) {
+    text(template.slice(last, match.index));
+    last = match.index + match[0].length;
+    const expression = match[1];
+    if (expression.startsWith("?") || expression.startsWith("!")) {
+      const alternatives = expression.slice(1).split("|").map((term) => {
+        const eq = term.indexOf("=");
+        const name = eq < 0 ? term : term.slice(0, eq);
+        if (!vars.known(name))
+          throw new CeError(`ce: unknown placeholder ${match[0]} in ${JSON.stringify(template)}`);
+        return eq < 0 ? { name } : { name, expected: term.slice(eq + 1) };
+      });
+      parts.push({
+        guard: match[0],
+        negate: expression.startsWith("!"),
+        alternatives
+      });
+    } else {
+      if (!vars.known(expression))
+        throw new CeError(`ce: unknown placeholder ${match[0]} in ${JSON.stringify(template)}`);
+      parts.push({ name: expression });
+    }
   }
+  text(template.slice(last));
+  return parts;
 }
-function isStale({ mtimeMs, owner }) {
-  if (Date.now() - mtimeMs > STALE_AFTER_MS)
+function failedGuard(parts, vars) {
+  let unknown;
+  for (const part of parts) {
+    if (!("guard" in part))
+      continue;
+    try {
+      let unresolved;
+      let matched = false;
+      for (const condition of part.alternatives) {
+        try {
+          const value = vars.get(condition.name);
+          if (value !== undefined && (condition.expected === undefined || value === condition.expected)) {
+            matched = true;
+            break;
+          }
+        } catch (exc) {
+          unresolved ??= exc;
+        }
+      }
+      if (!matched && unresolved !== undefined)
+        throw unresolved;
+      if (matched === part.negate) {
+        const only = part.alternatives.length === 1 ? part.alternatives[0] : undefined;
+        return {
+          guard: part.guard,
+          reason: only ? only.expected === undefined ? `${only.name} has ${part.negate ? "a" : "no"} value` : `${only.name} ${part.negate ? "matched" : "did not match"} the required value` : part.negate ? "an alternative matched" : "no alternative matched"
+        };
+      }
+    } catch (exc) {
+      unknown ??= exc;
+    }
+  }
+  if (unknown !== undefined)
+    throw unknown;
+  return;
+}
+function checkTemplate(template, vars) {
+  parse(template, vars);
+}
+function guardsPass(template, vars, onSkip) {
+  const failure = failedGuard(parse(template, vars), vars);
+  if (!failure)
     return true;
-  const match = /^(\d+)@(.*)$/u.exec(owner);
-  if (!match || match[2] !== hostname())
-    return false;
-  try {
-    process.kill(Number(match[1]), 0);
-    return false;
-  } catch (exc) {
-    return !isErrno(exc, "EPERM");
+  onSkip?.(failure);
+  return false;
+}
+function expand(template, vars, encode, onSkip) {
+  const parts = parse(template, vars);
+  const failure = failedGuard(parts, vars);
+  if (failure) {
+    onSkip?.(failure);
+    return null;
   }
+  return render(parts, vars, encode, (name) => `ce: {${name}} has no value here, in ${JSON.stringify(template)}. ` + `To leave the tag out instead, guard it with {?${name}}.`);
 }
-function breakIfStale(lockPath) {
-  const stale = snapshot(lockPath);
-  if (!stale || !isStale(stale))
-    return;
-  const guard = `${lockPath}.break`;
-  try {
-    fs3.writeFileSync(guard, "", { flag: "wx", mode: 384 });
-  } catch (exc) {
-    if (!isErrno(exc, "EEXIST"))
-      throw exc;
-    const held = snapshot(guard);
-    if (held && Date.now() - held.mtimeMs > STALE_AFTER_MS) {
-      throw new CeError(`stale lock guard ${JSON.stringify(guard)}: remove it if no ce is running`);
+function render(parts, vars, encode, missing) {
+  let out = "";
+  for (const part of parts) {
+    if ("text" in part)
+      out += part.text;
+    else if ("name" in part) {
+      const value = vars.get(part.name);
+      if (value === undefined)
+        throw new CeError(missing(part.name));
+      out += encode(value);
     }
-    return;
   }
-  try {
-    const current = snapshot(lockPath);
-    if (current && current.ino === stale.ino && current.mtimeMs === stale.mtimeMs && current.owner === stale.owner) {
-      fs3.rmSync(lockPath, { force: true });
+  return out;
+}
+function checkValue(template, vars, what, guards = false) {
+  const parts = parse(template, vars);
+  if (!guards && parts.some((part) => ("guard" in part) && part.guard)) {
+    throw new CeError(`ce: ${what} ${JSON.stringify(template)} cannot use guards here`);
+  }
+  return parts;
+}
+function expandValue(template, vars, encode, what, guards = false) {
+  const parts = checkValue(template, vars, what, guards);
+  if (failedGuard(parts, vars))
+    return "";
+  const hint = (name) => guards ? ` To leave the ${what} empty instead, guard it with {?${name}}.` : "";
+  return render(parts, vars, encode, (name) => `ce: {${name}} has no value here, in the ${what} ${JSON.stringify(template)}.${hint(name)}`);
+}
+
+// src/tags.ts
+function describeSkippedTag({
+  scope,
+  template,
+  guard,
+  reason
+}) {
+  return `${scope} ${JSON.stringify(template)}: ${guard} did not pass (${reason})`;
+}
+var INVALID_TAG_CHARS = /[^A-Za-z0-9_.\-]/gu;
+var INVALID_SCOPE_CHARS = /[^A-Za-z0-9_.:/\-]/gu;
+var VALID_TAG = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/u;
+var HOST_PORT = /^([^/:]+):(?:\d|\{[^{}]*\})+\//u;
+var SEPARATORS = "-_.";
+function sanitizeChars(value, charRegex) {
+  return value.replace(charRegex, "_");
+}
+function assertAscii(label, value) {
+  for (const ch of value) {
+    const code = ch.codePointAt(0);
+    if (code >= 128) {
+      const hex = code.toString(16).toUpperCase().padStart(4, "0");
+      throw new CeError(`ce: refusing to sanitize non-ASCII character ${JSON.stringify(ch)} ` + `(U+${hex}) in ${label} ${JSON.stringify(value)} — rename the ref ` + `or pass an explicit ASCII tag.`);
     }
-  } finally {
-    fs3.rmSync(guard, { force: true });
   }
 }
-async function withFileLock(lockPath, fn) {
-  const owner = `${process.pid}@${hostname()}`;
-  let ino;
-  for (;; ) {
-    let fd;
-    try {
-      fd = fs3.openSync(lockPath, "wx", 384);
-    } catch (exc) {
-      if (!isErrno(exc, "EEXIST"))
-        throw exc;
-      breakIfStale(lockPath);
-      await setTimeout2(POLL_MS);
+function stripProto(value) {
+  return value.replace(/^https?:\/\//u, "");
+}
+function splitOnce(value, sep) {
+  const i = value.indexOf(sep);
+  return i < 0 ? [value, ""] : [value.slice(0, i), value.slice(i + sep.length)];
+}
+function splitRef(value) {
+  const host = HOST_PORT.exec(value);
+  const isHost = host && (host[1].includes(".") || host[1] === "localhost" || value.includes(":", host[0].length));
+  const offset = isHost ? host[0].length : 0;
+  const i = value.indexOf(":", offset);
+  return i < 0 ? null : [value.slice(0, i), value.slice(i + 1)];
+}
+function assertValidTag(repo, tag) {
+  if (!VALID_TAG.test(tag)) {
+    throw new CeError(`ce: invalid tag ${JSON.stringify(tag)} in ${JSON.stringify(`${repo}:${tag}`)}: a tag is up to 128 letters, ` + `digits, "_", "." and "-", and cannot start with "." or "-".`);
+  }
+  return `${repo}:${tag}`;
+}
+function encodeTagValue(value) {
+  assertAscii("placeholder value", value);
+  return value.replace(INVALID_TAG_CHARS, "-");
+}
+function encodeRepoValue(value) {
+  assertAscii("placeholder value", value);
+  if (/[^A-Za-z0-9._:/-]/u.test(value))
+    throw new CeError(`ce: ${JSON.stringify(value)} cannot go in an image name`);
+  return value;
+}
+function expandImage(template, vars) {
+  const image = expandValue(template, vars, encodeRepoValue, "image name");
+  if (!/^(?:[^/:]+:\d+\/)?[^:]*$/u.test(image)) {
+    throw new CeError(`ce: image name ${JSON.stringify(image)} from ${JSON.stringify(template)} has a ":" that is not a registry port`);
+  }
+  return image;
+}
+function expandPrefix(prefix, vars, what) {
+  return hasPlaceholders(prefix) ? expandValue(prefix, vars, encodeTagValue, what, true) : prefix;
+}
+function literalRef(repo, tag) {
+  if (tag.includes("/")) {
+    const [first, rest] = splitOnce(tag, "/");
+    return `${repo}/${sanitizeChars(first, INVALID_TAG_CHARS)}:${sanitizeChars(rest, INVALID_TAG_CHARS)}`;
+  }
+  return `${repo}:${sanitizeChars(tag, INVALID_TAG_CHARS)}`;
+}
+function computeSafePrefix(prefix) {
+  assertAscii("tag prefix", prefix);
+  const p = sanitizeChars(prefix, INVALID_TAG_CHARS);
+  return p && !SEPARATORS.includes(p.at(-1)) ? `${p}-` : p;
+}
+function rewriteTagValue(value, tagPrefix, vars = new CiMetadata, { tagLists = new Map, onSkip } = {}) {
+  assertAscii("tag", value);
+  const guards = /^(?:\{[?!][^{}]*\})+/u.exec(value)?.[0] ?? "";
+  const v = stripProto(value.slice(guards.length));
+  if (!v)
+    throw new CeError("ce: empty -t/--tag value");
+  checkTemplate(guards, vars);
+  const [repoTemplate, tagList] = splitRef(v) ?? [v, undefined];
+  if (hasPlaceholders(repoTemplate))
+    checkValue(repoTemplate, vars, "image name");
+  if (hasPlaceholders(tagPrefix))
+    checkValue(tagPrefix, vars, "tag prefix", true);
+  let repo;
+  const expandRepo = () => repo ??= hasPlaceholders(repoTemplate) ? expandImage(repoTemplate, vars) : repoTemplate;
+  if (tagList === undefined) {
+    if (!guardsPass(guards, vars, (failure) => onSkip?.({ ...failure, template: value, scope: "destination" })))
+      return [];
+    return [expandRepo()];
+  }
+  const tags = expandTagLists(tagList, tagLists);
+  if (!tags.length)
+    throw new CeError(`ce: no tag after the ":" in ${JSON.stringify(value)}`);
+  for (const tag of tags) {
+    assertAscii("tag", tag);
+    checkTemplate(tag, vars);
+  }
+  let safePrefix;
+  const refs = [];
+  for (const tag of tags) {
+    let destinationSkipped = false;
+    const expanded = guards || hasPlaceholders(tag) ? expand(guards + tag, vars, encodeTagValue, (failure) => {
+      destinationSkipped = guards.includes(failure.guard);
+      onSkip?.({
+        ...failure,
+        template: destinationSkipped ? value : `${repoTemplate}:${tag}`,
+        scope: destinationSkipped ? "destination" : "tag"
+      });
+    }) : tag;
+    if (destinationSkipped)
+      return [];
+    if (expanded === null)
+      continue;
+    safePrefix ??= computeSafePrefix(expandPrefix(tagPrefix, vars, "tag prefix"));
+    if (hasPlaceholders(tag)) {
+      refs.push(assertValidTag(expandRepo(), `${safePrefix}${sanitizeChars(expanded, INVALID_TAG_CHARS)}`));
+    } else {
+      const ref = literalRef(expandRepo(), `${safePrefix}${tag}`);
+      const i = ref.lastIndexOf(":");
+      refs.push(assertValidTag(ref.slice(0, i), ref.slice(i + 1)));
+    }
+  }
+  return refs;
+}
+function csvFields(value) {
+  value = value.replace(/\r?\n$/u, "");
+  if (!value)
+    return null;
+  const fields = [];
+  let i = 0;
+  for (;; ) {
+    if (value[i] !== '"') {
+      const end = value.indexOf(",", i);
+      const field = end < 0 ? value.slice(i) : value.slice(i, end);
+      if (field.includes('"'))
+        return null;
+      fields.push(field);
+      if (end < 0)
+        return fields;
+      i = end + 1;
       continue;
     }
-    try {
-      fs3.writeSync(fd, `${owner}
-`);
-      ino = fs3.fstatSync(fd).ino;
-    } finally {
-      fs3.closeSync(fd);
+    let field = "";
+    for (i++;; i++) {
+      const quote = value.indexOf('"', i);
+      if (quote < 0)
+        return null;
+      field += value.slice(i, quote);
+      i = quote + 1;
+      if (value[i] !== '"')
+        break;
+      field += '"';
     }
-    break;
-  }
-  try {
-    return await fn();
-  } finally {
-    const current = snapshot(lockPath);
-    if (current?.ino === ino && current.owner === owner)
-      fs3.rmSync(lockPath, { force: true });
+    fields.push(field);
+    if (i === value.length)
+      return fields;
+    if (value[i] !== ",")
+      return null;
+    i++;
   }
 }
-
-// src/state.ts
-var HELPER_SUFFIX = "ce-forgejo";
-var STATE_FILE = "ce-forgejo-credentials.json";
-function dockerConfigDir() {
-  const configured = process.env.DOCKER_CONFIG;
-  if (!configured)
-    return path3.join(homedir(), ".docker");
-  const expanded = configured === "~" || configured.startsWith("~/") ? path3.join(homedir(), configured.slice(1)) : configured;
-  return path3.resolve(expanded);
-}
-function helperStatePath() {
-  return path3.join(dockerConfigDir(), STATE_FILE);
+function csvJoin(fields) {
+  return fields.map((field) => /^[ \t]|[",\r\n]/u.test(field) ? `"${field.replaceAll('"', '""')}"` : field).join(",");
 }
-async function withHelperState(fn) {
-  const statePath = helperStatePath();
-  fs4.mkdirSync(path3.dirname(statePath), { recursive: true, mode: 448 });
-  return withFileLock(`${statePath}.pidlock`, async () => {
-    const state = readJsonFile(statePath, { version: 1, registries: {} });
-    if (!isObject(state) || !isObject(state.registries)) {
-      throw new CeError("Forgejo credential-helper state is invalid");
-    }
-    const before = JSON.stringify(state);
-    const result = await fn(state);
-    if (JSON.stringify(state) !== before)
-      writePrivateJson(statePath, state);
-    return result;
-  });
+var fieldKey = (field) => field.split("=", 1)[0].toLowerCase();
+function ghaFields(value) {
+  const fields = csvFields(value);
+  const type = fields?.findLast((field) => fieldKey(field) === "type");
+  return type?.slice("type=".length) === "gha" ? fields : null;
 }
-async function saveHelperState(registry, username, audience, authority, jwt) {
-  const expiry = jwtExpiry(jwt);
-  if (needsRefresh(expiry))
-    throw new CeError("OIDC token expires within the five-minute refresh window");
-  await withHelperState((state) => {
-    state.registries[registryKey(registry)] = {
-      audience,
-      authority: [authority[0], authority[1]],
-      expires_at: expiry,
-      token: jwt,
-      username
-    };
-  });
+var isGhaCache = (value) => ghaFields(value) !== null;
+var scopeIndex = (fields) => fields.findLastIndex((field) => fieldKey(field) === "scope");
+function cacheScopeName(value) {
+  const fields = ghaFields(value);
+  if (!fields)
+    return value;
+  const i = scopeIndex(fields);
+  if (i < 0)
+    return "";
+  const scope = fields[i].slice("scope=".length);
+  assertAscii("cache scope", scope);
+  return sanitizeChars(scope, INVALID_SCOPE_CHARS);
 }
-async function configureDockerCredentialHelper(registry, username, audience, authority, jwt) {
-  await saveHelperState(registry, username, audience, authority, jwt);
-  const configPath = path3.join(dockerConfigDir(), "config.json");
-  const config = readJsonFile(configPath, {});
-  if (!isObject(config))
-    throw new CeError("Docker config is not a JSON object");
-  config.credHelpers ??= {};
-  const helpers = config.credHelpers;
-  if (!isObject(helpers))
-    throw new CeError("Docker config 'credHelpers' is not a JSON object");
-  helpers[registry] = HELPER_SUFFIX;
-  const auths = config.auths;
-  if (isObject(auths)) {
-    for (const key of Object.keys(auths)) {
-      if (registryKey(key) === registryKey(registry))
-        delete auths[key];
-    }
+function normalizeCacheScope(value, cachePrefix) {
+  const fields = ghaFields(value);
+  if (!fields)
+    return value;
+  if (!cachePrefix)
+    return value;
+  assertAscii("cache prefix", cachePrefix);
+  const prefix = sanitizeChars(cachePrefix, INVALID_TAG_CHARS);
+  let scope = cacheScopeName(value);
+  if (!scope) {
+    scope = prefix.replace(/[-_.]+$/u, "");
+  } else if (prefix) {
+    scope = SEPARATORS.includes(prefix.at(-1)) ? `${prefix}${scope}` : `${prefix}-${scope}`;
   }
-  writePrivateJson(configPath, config);
+  const i = scopeIndex(fields);
+  if (i < 0)
+    fields.push(`scope=${scope}`);
+  else
+    fields[i] = `scope=${scope}`;
+  return csvJoin(fields);
+}
+function withoutCacheMode(value) {
+  const fields = ghaFields(value);
+  if (!fields?.some((field) => fieldKey(field) === "mode"))
+    return value;
+  return csvJoin(fields.filter((field) => fieldKey(field) !== "mode"));
 }
 
-// src/credential-helper.ts
-async function helperGet(registry) {
-  const key = registryKey(registry);
-  return withHelperState(async (state) => {
-    const entry = state.registries[key];
-    if (!isObject(entry)) {
-      throw new CeError(`no Forgejo OIDC credentials configured for ${JSON.stringify(registry)}`);
-    }
-    const { username, token, expires_at: expiry } = entry;
-    if (typeof username !== "string" || !username) {
-      throw new CeError("Forgejo credential-helper username is missing");
-    }
-    if (typeof token !== "string" || typeof expiry !== "number") {
-      throw new CeError("Forgejo credential-helper token state is invalid");
-    }
-    if (!needsRefresh(expiry))
-      return { Username: username, Secret: token };
-    const { audience, authority } = entry;
-    const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL ?? "";
-    const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN ?? "";
-    if (typeof audience !== "string" || !audience) {
-      throw new CeError("Forgejo credential-helper audience is missing");
-    }
-    if (!(requestUrl && requestToken)) {
-      throw new CeError("OIDC refresh requires ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN");
-    }
-    const [host, port] = urlAuthority(requestUrl);
-    if (!Array.isArray(authority) || authority.length !== 2 || authority[0] !== host || authority[1] !== port) {
-      throw new CeError("OIDC token-request host does not match the registry");
+// src/build-args.ts
+function consumeValue(argv, flag) {
+  if (argv.length === 0)
+    throw new CeError(`ce: ${flag} requires a value but none was provided.`);
+  const v = argv[0];
+  if (v.length > 1 && v.startsWith("-")) {
+    throw new CeError(`ce: ${flag} requires a value but the next token ${JSON.stringify(v)} looks like a flag.`);
+  }
+  return [v, argv.slice(1)];
+}
+var SUMMARIZED = {
+  "-f": "dockerfile",
+  "--file": "dockerfile",
+  "--target": "target",
+  "--platform": "platform",
+  "--build-arg": "buildArgs",
+  "--label": "labels",
+  "--annotation": "annotations"
+};
+var ARG_VARIABLE = /^arg\.([A-Za-z_][A-Za-z0-9_]*)$/u;
+var PLATFORM_FROM = {
+  podman: [5, 2],
+  buildah: [1, 37]
+};
+var PLATFORM_PARTS = [
+  "--arch",
+  "--os",
+  "--variant",
+  "--override-arch",
+  "--override-os",
+  "--os-version",
+  "--os-feature"
+];
+function withBuildArgs(vars, values, argFile, fromFile) {
+  return {
+    known: (name) => ARG_VARIABLE.test(name) || vars.known(name),
+    get(name) {
+      const arg = ARG_VARIABLE.exec(name)?.[1];
+      if (arg === undefined)
+        return vars.get(name);
+      const value = values.get(arg);
+      if (typeof value === "string")
+        return value || undefined;
+      if (argFile) {
+        throw new CeError(`ce: {${name}} has no value from --build-arg, and may get one from --build-arg-file, which ce does not read`);
+      }
+      return fromFile(arg) || undefined;
     }
-    const refreshed = await forgejoOidcJwt(audience, requestUrl, requestToken);
-    const refreshedExpiry = jwtExpiry(refreshed);
-    if (needsRefresh(refreshedExpiry)) {
-      throw new CeError("refreshed OIDC token expires within the five-minute window");
+  };
+}
+var SHORT_BOOLS = {
+  docker: "qD",
+  podman: "qD",
+  buildah: "qD"
+};
+var BUILDX_VALUES = "add-host allow annotation attest build-arg build-context builder cache-from cache-to call cgroup-parent cpu-period cpu-quota cpu-shares cpuset-cpus cpuset-mems file iidfile isolation label memory memory-swap metadata-file network no-cache-filter output platform policy print progress provenance resource sbom secret security-opt shm-size ssh tag target ulimit";
+var BUILDAH_VALUES = "add-host annotation arch authfile blob-cache blob-info-cache-dir build-arg build-arg-file build-context cache-from cache-to cache-ttl cap-add cap-drop cdi-config-dir cert-dir cgroup-parent cgroupns compression-format compression-level cpp-flag cpu-period cpu-quota cpu-shares cpuset-cpus cpuset-mems creds cw decryption-key device dns dns-option dns-search env file format from group-add hooks-dir ignorefile iidfile iidfile-raw ipc isolation jobs label layer-label logfile loglevel manifest memory memory-swap metadata-file mount net network os os-feature os-version output override-arch override-os pid platform progress raw-iidfile retry retry-delay runtime-flag rusage-logfile sbom sbom-image-output sbom-image-purl-output sbom-merge-strategy sbom-output sbom-purl-output sbom-scanner-command sbom-scanner-image secret security-opt shm-size sign-by signature-policy source-date-epoch source-policy-file ssh tag target timestamp ulimit unsetannotation unsetenv unsetlabel userns userns-gid-map userns-gid-map-group userns-uid-map userns-uid-map-user uts variant volume";
+var PODMAN_ROOT_VALUES = "cdi-spec-dir cgroup-manager conmon cpu-profile db-backend default-mounts-file events-backend hooks-dir imagestore log-level max-workers memory-profile namespace network-backend network-cmd-path network-config-dir pull-option registries-conf root runroot runtime runtime-flag storage-driver storage-opt tmpdir volumepath";
+var BUILDAH_ROOT_VALUES = "cgroup-manager cpu-profile default-mounts-file imagestore log-level memory-profile registries-conf registries-conf-dir root runroot short-name-alias-conf storage-driver storage-opt userns-gid-map userns-uid-map";
+var VALUE_FLAGS = {
+  docker: new Set(BUILDX_VALUES.split(" ")),
+  podman: new Set(`${BUILDAH_VALUES} ${PODMAN_ROOT_VALUES}`.split(" ")),
+  buildah: new Set(`${BUILDAH_VALUES} runtime ${BUILDAH_ROOT_VALUES}`.split(" "))
+};
+var SHORT_VALUES = {
+  docker: "cfmot",
+  podman: "cfmotv",
+  buildah: "cfmotv"
+};
+var takesValue = (arg, engine) => arg.startsWith("--") ? VALUE_FLAGS[engine].has(arg.slice(2)) : arg.length === 2 && SHORT_VALUES[engine].includes(arg[1]);
+function ungroup(argv, engine) {
+  const out = [];
+  for (let at = 0;at < argv.length; at++) {
+    const arg = argv[at];
+    if (arg === "--") {
+      out.push(...argv.slice(at));
+      break;
     }
-    entry.token = refreshed;
-    entry.expires_at = refreshedExpiry;
-    return { Username: username, Secret: refreshed };
-  });
+    const split = [];
+    let i = 1;
+    if (/^-[^-]/u.test(arg))
+      while (i < arg.length - 1 && SHORT_BOOLS[engine].includes(arg[i]) && arg[i + 1] !== "=")
+        split.push(`-${arg[i++]}`);
+    split.push(i === 1 ? arg : `-${arg.slice(i)}`);
+    out.push(...split);
+    if (takesValue(split.at(-1), engine) && at + 1 < argv.length)
+      out.push(argv[++at]);
+  }
+  return out;
 }
-async function helperStore(input) {
-  const payload = JSON.parse(input);
-  if (!isObject(payload))
-    throw new CeError("credential-helper store payload is invalid");
-  const { ServerURL: registry, Username: username, Secret: secret } = payload;
-  const filled = (value) => typeof value === "string" && value !== "";
-  if (!(filled(registry) && filled(username) && filled(secret))) {
-    throw new CeError("credential-helper store fields are incomplete");
+function parseBuildArgs(given, tagPrefix, cachePrefix, {
+  vars = new CiMetadata,
+  tagLists,
+  labels = {},
+  defaultBranch,
+  env = process.env,
+  engine = "docker",
+  buildx = false,
+  engineVersion,
+  sbom = false
+} = {}) {
+  const argv = ungroup(given, engine);
+  const parts = [];
+  const rawCacheFrom = [];
+  const rawCacheTo = [];
+  const summary = {
+    tags: [],
+    skippedTags: [],
+    cacheFrom: [],
+    cacheTo: [],
+    buildArgs: [],
+    labels: [],
+    annotations: [],
+    dockerfile: "",
+    target: "",
+    platform: "",
+    context: ""
+  };
+  let templated = false;
+  const buildArgs = new Map;
+  let argFile = false;
+  const files = [];
+  const positionals = [];
+  const contexts = [];
+  const envs = [];
+  const platforms = [];
+  let platformParts = false;
+  let fromImage;
+  let format = env["BUILDAH_FORMAT"];
+  const sbomFlags = [];
+  const times = new Map;
+  let epochArg;
+  let allPlatforms = false;
+  let rest = [];
+  const addTags = (value, flag) => {
+    templated ||= hasPlaceholders(value);
+    parts.push({ tags: value, flag });
+  };
+  const summarize = (flag, value) => {
+    const field = SUMMARIZED[flag];
+    if (field === "buildArgs") {
+      const [key, given] = value.includes("=") ? splitAt(value, "=") : [value, Object.hasOwn(env, value) ? env[value] : undefined];
+      if (given !== undefined)
+        buildArgs.set(key, given);
+      else if (engine !== "docker")
+        buildArgs.set(value, null);
+      if (key === "SOURCE_DATE_EPOCH" && given !== undefined)
+        epochArg = given;
+      else if (key === "SOURCE_DATE_EPOCH" && engine !== "docker")
+        epochArg = undefined;
+      if (engine !== "docker" && buildArgs.has("TARGETPLATFORM"))
+        buildArgs.set("TARGETPLATFORM", null);
+      const epoch = buildArgs.get("SOURCE_DATE_EPOCH");
+      if (engine === "docker" && typeof epoch === "string" && !(/^(?:0|-?[1-9][0-9]*)$/u.test(epoch) && BigInt(epoch) >= -(2n ** 63n) && BigInt(epoch) < 2n ** 63n))
+        buildArgs.set("SOURCE_DATE_EPOCH", null);
+    }
+    if (field === "dockerfile")
+      files.push(value);
+    if (field === "platform") {
+      platforms.push(...value.split(","));
+      summary.platform = platforms.join(",");
+    } else if (field === "buildArgs" || field === "labels" || field === "annotations")
+      summary[field].push(value);
+    else
+      summary[field] = value;
+  };
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i];
+    const [name, attached] = arg.startsWith("--") && arg.includes("=") ? splitAt(arg, "=") : [arg, undefined];
+    const next = () => consumeValue(argv.slice(++i), arg)[0];
+    const short = () => arg.slice(arg[2] === "=" ? 3 : 2);
+    if (engine !== "docker" && PLATFORM_PARTS.includes(name))
+      platformParts = true;
+    if (engine !== "docker" && name === "--format")
+      format = attached ?? argv[i + 1];
+    if (engine !== "docker" && name === "--all-platforms")
+      allPlatforms = attached === undefined || !/^(?:0|f|false)$/iu.test(attached);
+    if (engine !== "docker" && name === "--from")
+      fromImage = attached ?? argv[i + 1] ?? "";
+    if (name.startsWith("--sbom") || name === "--attest")
+      sbomFlags.push([name, attached ?? argv[i + 1] ?? ""]);
+    if (engine !== "docker" && (name === "--timestamp" || name === "--source-date-epoch"))
+      times.set(name, attached ?? argv[i + 1] ?? "");
+    if (arg === "--") {
+      rest = argv.slice(i);
+      positionals.push(...rest.slice(1));
+      if (rest.length > 1)
+        summary.context = rest.at(-1);
+      break;
+    } else if (arg === "-t")
+      addTags(next(), "-t");
+    else if (arg === "--tag")
+      addTags(next(), "--tag=");
+    else if (arg.startsWith("-t"))
+      addTags(short(), "-t");
+    else if (name === "--tag")
+      addTags(attached, "--tag=");
+    else if (name === "--cache-from")
+      rawCacheFrom.push(attached ?? next());
+    else if (name === "--cache-to")
+      rawCacheTo.push(attached ?? next());
+    else if (name === "--cache") {
+      const v = attached ?? next();
+      rawCacheFrom.push(withoutCacheMode(v));
+      rawCacheTo.push(v);
+    } else if (Object.hasOwn(SUMMARIZED, name)) {
+      const flag = name;
+      if (attached === undefined) {
+        const v = next();
+        parts.push(arg, v);
+        summarize(flag, v);
+      } else {
+        parts.push(arg);
+        summarize(flag, attached);
+      }
+    } else if (name === "--build-arg-file") {
+      argFile = true;
+      parts.push(arg);
+      if (attached === undefined)
+        parts.push(next());
+    } else if (name === "--build-context") {
+      const v = attached ?? next();
+      parts.push(arg);
+      if (attached === undefined)
+        parts.push(v);
+      contexts.push(v.split("=")[0]);
+    } else if ((name === "--env" || name === "--unsetenv") && engine !== "docker") {
+      const v = attached ?? next();
+      parts.push(arg);
+      if (attached === undefined)
+        parts.push(v);
+      envs.push(`${name} ${v}`);
+    } else if (arg.startsWith("-f") && arg.length > 2) {
+      parts.push(arg);
+      summary.dockerfile = short();
+      files.push(summary.dockerfile);
+    } else if (takesValue(arg, engine) && i + 1 < argv.length) {
+      parts.push(arg, argv[++i]);
+    } else {
+      parts.push(arg);
+      if (!arg.startsWith("-")) {
+        positionals.push(arg);
+        summary.context = arg;
+      }
+    }
   }
-  const expiry = jwtExpiry(secret);
-  await withHelperState((state) => {
-    const entry = state.registries[registryKey(registry)] ??= {};
-    Object.assign(entry, { expires_at: expiry, token: secret, username });
+  const whyIgnored = () => {
+    if (allPlatforms)
+      return `--all-platforms builds for the platforms of the base images, which ce does not read`;
+    if (platformParts)
+      return `${engine}'s --arch, --os or --variant changes the platform, which ce does not follow`;
+    const from = PLATFORM_FROM[engine];
+    if (!from || !platforms.length)
+      return;
+    const since = `ce follows how ${engine} sets it from --platform only from ${from.join(".")}`;
+    const version = engineVersion?.();
+    if (version === undefined)
+      return `${since}, and cannot tell which version builds`;
+    return older(version, from) ? `${since}, and this is ${version}` : undefined;
+  };
+  let ignored;
+  const platformIgnored = () => (ignored ??= { why: whyIgnored() }).why;
+  const baseVars = vars;
+  const buildFiles = {
+    engine,
+    files,
+    positionals,
+    target: summary.target,
+    contexts,
+    envs,
+    env,
+    platforms,
+    platformIgnored,
+    format: format === "oci" || format === "docker" ? format : undefined,
+    from: fromImage
+  };
+  const buildArg = (arg) => buildArgs.get(arg) ?? undefined;
+  const fromFile = containerfileDefaults(buildFiles, buildArg);
+  vars = withBuildArgs(baseVars, buildArgs, argFile, fromFile);
+  const args = parts.flatMap((part) => {
+    if (typeof part === "string")
+      return [part];
+    const refs = [
+      ...new Set(rewriteTagValue(part.tags, tagPrefix, vars, {
+        tagLists,
+        onSkip: (skipped) => summary.skippedTags.push(skipped)
+      }))
+    ].filter((ref) => !summary.tags.includes(ref));
+    summary.tags.push(...refs);
+    return refs.map((ref) => `${part.flag}${ref}`);
   });
-}
-async function credentialHelper(argv) {
-  const [command] = argv;
-  if (argv.length !== 1 || !["get", "store", "erase", "list"].includes(command)) {
-    logError("ce: credential-helper requires get|store|erase|list");
-    return 1;
+  if (templated && !summary.tags.length) {
+    throw new CeError("ce: the guards in the -t templates left out every tag, so the image would have none" + summary.skippedTags.map((skipped) => `
+  - ${describeSkippedTag(skipped)}`).join(""));
   }
-  try {
-    if (command === "get") {
-      io.stdout(`${JSON.stringify(await helperGet(io.stdin().trim()))}
-`);
-    } else if (command === "store") {
-      await helperStore(io.stdin());
-    } else if (command === "erase") {
-      const key = registryKey(io.stdin().trim());
-      await withHelperState((state) => void delete state.registries[key]);
-    } else {
-      const entries = await withHelperState((state) => Object.fromEntries(Object.entries(state.registries).filter(([, entry]) => isObject(entry)).map(([key, entry]) => [key, entry.username ?? ""])));
-      io.stdout(`${JSON.stringify(entries)}
-`);
-    }
-    return 0;
-  } catch (exc) {
-    if (!(exc instanceof CeError || exc instanceof SyntaxError || isErrno(exc)))
-      throw exc;
-    logError(`ce: Forgejo credential helper: ${errorMessage(exc)}`);
-    return 1;
+  const CREATED = "org.opencontainers.image.created";
+  const timestamp = times.get("--timestamp");
+  const flagEpoch = timestamp ?? times.get("--source-date-epoch");
+  let epoch;
+  if (engine === "docker")
+    epoch = epochArg ?? (env["SOURCE_DATE_EPOCH"] || !labels[CREATED] ? undefined : dockerfileEpoch(buildFiles, buildArg));
+  else if (flagEpoch !== undefined || env["SOURCE_DATE_EPOCH"])
+    epoch = flagEpoch;
+  else
+    epoch = epochArg ?? (argFile ? "" : undefined);
+  const time = epoch === undefined ? undefined : epochDate(epoch, timestamp === undefined ? 10 : 0);
+  const metadata = Object.entries(labels).filter(([key]) => key !== CREATED || epoch === undefined || time).map(([key, value]) => [
+    key,
+    time && key === CREATED ? rfc3339(time) : value
+  ]);
+  const ownLabels = new Set(summary.labels.map((label) => label.split("=", 1)[0]));
+  const ownAnnotations = new Set(summary.annotations.map((annotation) => annotationKey(annotation, engine)));
+  const addedLabels = metadata.filter(([key, value]) => !ownLabels.has(key) && (engine === "docker" || !(value.includes("$") || engineEscapes(value)))).map(([key, value]) => `${key}=${value}`);
+  const level = engine === "docker" && indexed(platforms) ? "manifest,index:" : "";
+  const addedAnnotations = annotates(engine, env, buildx) ? metadata.filter(([key]) => !ownAnnotations.has(key)).map(([key, value]) => `${level}${key}=${value}`) : [];
+  args.unshift(...addedLabels.map((label) => `--label=${label}`), ...addedAnnotations.map((annotation) => `--annotation=${annotation}`), ...sbomArgs(engine, sbom, sbomFlags));
+  summary.labels.unshift(...addedLabels);
+  summary.annotations.unshift(...addedAnnotations);
+  const prefixTemplate = cachePrefix;
+  if (rawCacheFrom.length || rawCacheTo.length)
+    cachePrefix = expandPrefix(cachePrefix, vars, "cache prefix");
+  const toNames = new Set(rawCacheTo.map(cacheScopeName));
+  const cacheFrom = rawCacheFrom.map((c) => toNames.has(cacheScopeName(c)) ? normalizeCacheScope(c, cachePrefix) : c);
+  const ghaTo = rawCacheTo.filter(isGhaCache);
+  if (defaultBranch && ghaTo.length) {
+    const fileArg = (arg) => {
+      throw new CeError(`ce: the default branch's cache scope cannot use {arg.${arg}} from the Containerfile, which may differ there`);
+    };
+    const onDefault = withBuildArgs(onDefaultBranch(baseVars, defaultBranch()), buildArgs, argFile, fileArg);
+    const prefix = expandPrefix(prefixTemplate, onDefault, "cache prefix");
+    cacheFrom.push(...ghaTo.map((c) => normalizeCacheScope(withoutCacheMode(c), prefix)));
+  }
+  for (const rewritten of new Set(cacheFrom)) {
+    args.push(`--cache-from=${rewritten}`);
+    summary.cacheFrom.push(rewritten);
+  }
+  for (const c of rawCacheTo) {
+    const rewritten = normalizeCacheScope(c, cachePrefix);
+    args.push(`--cache-to=${rewritten}`);
+    summary.cacheTo.push(rewritten);
   }
+  args.push(...rest);
+  return { args, summary, vars };
+}
+function annotationKey(annotation, engine) {
+  const key = annotation.split("=", 1)[0];
+  return engine === "docker" ? key.replace(/^[a-z-]+(?:\[[^\]]*\])?(?:,[a-z-]+(?:\[[^\]]*\])?)*:/u, "") : key;
+}
+var annotates = (engine, env, buildx) => engine !== "docker" || buildx || !["0", "f", "false"].includes((env["DOCKER_BUILDKIT"] ?? "").toLowerCase());
+function indexed(platforms) {
+  const normalized = platforms.map((p) => normalizePlatform(p, "docker"));
+  return normalized.every((p) => p !== undefined) && new Set(normalized).size > 1;
+}
+var SBOM_PATH = "/root/buildinfo/content_manifests/sbom";
+function sbomArgs(engine, sbom, flags) {
+  if (engine === "docker") {
+    const asked = flags.some(([name, value]) => name === "--sbom" || name === "--attest" && csvFields(value)?.findLast((field) => fieldKey(field) === "type")?.slice("type=".length) === "sbom");
+    if (!sbom || asked)
+      return [];
+    if (sbom === "cyclonedx")
+      throw new CeError("ce: SBOM=cyclonedx is not supported by Docker's BuildKit SBOM attestation; use SBOM=spdx or SBOM=true");
+    return ["--sbom=true"];
+  }
+  const preset = flags.findLast(([name]) => name === "--sbom")?.[1];
+  const output = flags.some(([name]) => [
+    "--sbom-output",
+    "--sbom-image-output",
+    "--sbom-purl-output",
+    "--sbom-image-purl-output"
+  ].includes(name));
+  const used = preset ?? (sbom ? `syft-${sbom === "cyclonedx" ? "cyclonedx" : "spdx"}` : undefined);
+  if (used === undefined)
+    return [];
+  const args = preset === undefined ? [`--sbom=${used}`] : [];
+  if (!output)
+    args.push(`--sbom-image-output=${SBOM_PATH}${used.endsWith("-spdx") ? ".spdx.json" : ".cdx.json"}`);
+  return args;
+}
+function older(version, than) {
+  const parts = /^(\d+)\.(\d+)/u.exec(version)?.slice(1).map(Number);
+  if (!parts)
+    return true;
+  const i = parts.findIndex((n, j) => n !== than[j]);
+  return i !== -1 && parts[i] < than[i];
+}
+function splitAt(value, sep) {
+  const i = value.indexOf(sep);
+  return [value.slice(0, i), value.slice(i + 1)];
+}
+function printBuildSummary(engine, args, summary) {
+  const command = findBuildCommand(engine, args);
+  if (!command || command.tagsOnly)
+    return;
+  const subcommand = command.name;
+  const out = [
+    "[ce] build summary:",
+    `  engine: ${engine}`,
+    `  subcommand: ${subcommand}`
+  ];
+  const list = (title, items) => {
+    if (items.length)
+      out.push(`  ${title}:`, ...items.map((item) => `    - ${item}`));
+  };
+  list("tags", summary.tags);
+  list("cache-from", summary.cacheFrom);
+  list("cache-to", summary.cacheTo);
+  if (summary.dockerfile)
+    out.push(`  dockerfile: ${summary.dockerfile}`);
+  if (summary.target)
+    out.push(`  target: ${summary.target}`);
+  if (summary.platform)
+    out.push(`  platform: ${summary.platform}`);
+  list("build args", summary.buildArgs);
+  list("labels", summary.labels);
+  list("annotations", summary.annotations);
+  if (summary.context)
+    out.push(`  context: ${summary.context}`);
+  io.stderr(`${out.join(`
+`)}
+
+`);
 }
 
 // src/engine.ts
 var isEngine = (value) => ["docker", "podman", "buildah"].includes(value);
 var WAIT_ATTEMPTS = 30;
-async function waitForEngine(engine) {
+async function waitForEngine(engine, options = []) {
   if (engine === "buildah")
     return true;
+  const argv = [engine, ...options, "info"];
+  let stderr = "";
   for (let attempt = 1;attempt <= WAIT_ATTEMPTS; attempt++) {
-    if (system.run([engine, "info"]).status === 0)
+    const result = system.run(argv);
+    if (result.status === 0)
       return true;
+    stderr = result.stderr.trim();
     logError(`waiting for ${engine}... (${attempt}/${WAIT_ATTEMPTS})`);
     await system.sleep(1000);
   }
   logError(`no engine available: ${engine}`);
+  if (stderr)
+    logError(`${argv.map(shellQuote).join(" ")} last said:
+${stderr}`);
   return false;
 }
-function envFlag(name) {
-  const value = (process.env[name] ?? "").toLowerCase();
-  if (["", "0", "false", "no"].includes(value))
-    return false;
-  if (["1", "true", "yes"].includes(value))
-    return true;
-  throw new CeError(`ce: ${name} must be true or false, not ${JSON.stringify(process.env[name])}`);
+function engineVersion(engine, options = []) {
+  const argv = engine === "podman" ? ["podman", ...options, "info", "--format", "{{.Version.Version}}"] : ["buildah", "--version"];
+  for (let attempt = 1;; attempt++) {
+    let result;
+    try {
+      result = system.output(argv);
+    } catch {
+      return;
+    }
+    if (result.status === 0)
+      return /^(?:buildah version )?(\d+\.\d+\.\d+)\b/u.exec(result.stdout.trim())?.[1];
+    if (engine === "buildah" || attempt === WAIT_ATTEMPTS)
+      return;
+    logError(`waiting for ${engine}... (${attempt}/${WAIT_ATTEMPTS})`);
+    system.sleepSync(1000);
+  }
 }
-async function runEngine(engine, argv, tagPrefix, cachePrefix, ociLabels) {
+function sbomOption() {
+  const value = (process.env["SBOM"] ?? "").toLowerCase();
+  if (value === "spdx" || value === "cyclonedx")
+    return value;
+  return envFlag("SBOM", false, "true, false, spdx or cyclonedx");
+}
+async function runEngine(engine, argv, tagPrefix, cachePrefix, options = {}) {
+  const dryRun = options.dryRun ?? envFlag("CE_DRY_RUN");
+  ensureHelperOnPath();
   const command = findBuildCommand(engine, argv);
   let args = argv;
   let summary;
   if (command) {
     const vars = new CiMetadata;
-    const labels = !command.tagsOnly && (ociLabels ?? envFlag("OCI_LABELS")) ? vars.labels() : {};
-    const parsed = parseBuildArgs(argv.slice(command.start), tagPrefix, cachePrefix, { vars, labels });
+    const labels = !command.tagsOnly && (options.ociLabels ?? envFlag("OCI_LABELS", true)) ? vars.labels() : {};
+    const sbom = !command.tagsOnly && sbomOption();
+    const fromDefault = !command.tagsOnly && (options.cacheFromDefault ?? envFlag("CACHE_FROM_DEFAULT"));
+    const parsed = parseBuildArgs(argv.slice(command.start), tagPrefix, cachePrefix, {
+      engine,
+      buildx: command.buildx,
+      vars,
+      tagLists: options.tagLists,
+      labels,
+      sbom,
+      defaultBranch: fromDefault ? () => vars.defaultBranch() : undefined,
+      engineVersion: engine === "docker" ? undefined : () => engineVersion(engine, command.engineOptions)
+    });
     args = [...argv.slice(0, command.start), ...parsed.args];
     summary = parsed.summary;
   }
-  ensureHelperOnPath();
+  if (dryRun) {
+    if (summary)
+      printBuildSummary(engine, args, summary);
+    if (summary?.skippedTags.length) {
+      const skipped = summary.skippedTags.map((skipped) => `  - ${describeSkippedTag(skipped)}`);
+      io.stderr(`[ce] skipped tags:
+${skipped.join(`
+`)}
+
+`);
+    }
+    if (!system.which(engine))
+      logError(`ce: warning: ${engine} is not on PATH, so running this here would fail`);
+    io.stdout(`${[engine, ...args].map(shellQuote).join(" ")}
+`);
+    return 0;
+  }
   if (!system.which(engine)) {
     logError(`Engine not found: ${engine}`);
     return 1;
   }
-  if (!await waitForEngine(engine))
+  if (!await waitForEngine(engine, command?.engineOptions))
     return 1;
   if (summary)
     printBuildSummary(engine, args, summary);
-  if (engine === "docker")
-    return system.exec("docker", ["docker", ...args]);
-  if (system.which("gosu")) {
-    const user = process.env.USER ?? "";
-    if (!user) {
-      logError("ce: gosu is available but USER is not set; cannot drop privileges. Set USER or remove gosu from PATH.");
-      return 1;
-    }
-    return system.exec("gosu", ["gosu", user, engine, ...args]);
-  }
   return system.exec(engine, [engine, ...args]);
 }
 
@@ -1218,26 +2687,41 @@ function oidcConfig() {
     return null;
   const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL ?? "";
   const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN ?? "";
-  const missing = ["ACTIONS_ID_TOKEN_REQUEST_URL", "ACTIONS_ID_TOKEN_REQUEST_TOKEN"].filter((name) => !process.env[name]);
+  const missing = [
+    "ACTIONS_ID_TOKEN_REQUEST_URL",
+    "ACTIONS_ID_TOKEN_REQUEST_TOKEN"
+  ].filter((name) => !process.env[name]);
   if (missing.length) {
     return `Forgejo OIDC login config is incomplete: AUD is set, but ${missing.map(unsetOrEmpty).join("; ")}`;
   }
   try {
     assertAbsoluteHttpUrl(requestUrl, "must be an absolute HTTP(S) URL");
-    return { audience, requestUrl, requestToken, authority: urlAuthority(requestUrl) };
+    return {
+      audience,
+      requestUrl,
+      requestToken,
+      authority: urlAuthority(requestUrl)
+    };
   } catch (exc) {
     if (!(exc instanceof CeError))
       throw exc;
     return `Invalid ACTIONS_ID_TOKEN_REQUEST_URL: ${exc.message}`;
   }
 }
-function loginWithEngines(target, password) {
-  for (const engine of ENGINES) {
+function loginWithEngines(target, password, engines) {
+  for (const engine of engines) {
     if (!system.which(engine))
       continue;
     let result;
     try {
-      result = system.run([engine, "login", "-u", target.user, "--password-stdin", target.registry], `${password}
+      result = system.run([
+        engine,
+        "login",
+        "-u",
+        target.user,
+        "--password-stdin",
+        target.registry
+      ], `${password}
 `);
     } catch (exc) {
       if (isErrno(exc, "ENOENT"))
@@ -1251,12 +2735,13 @@ function loginWithEngines(target, password) {
   }
   return null;
 }
-async function login() {
+async function login(engine, dryRun = false) {
   ensureHelperOnPath();
+  const engines = engine ? [engine] : ENGINES;
   const groups = registryGroups();
   if (groups.length === 0) {
-    log("Skipping login: no REGISTRY_HOST env vars set");
-    return 0;
+    logError("ce: no registries to log in to; set REGISTRY_HOST, REGISTRY_USER and REGISTRY_PASSWORD");
+    return 1;
   }
   const oidc = oidcConfig();
   if (typeof oidc === "string") {
@@ -1280,7 +2765,10 @@ async function login() {
       try {
         const authority = urlAuthority(rawRegistry);
         const registry = registryServer(rawRegistry);
-        registries.push({ registry, useOidc: oidc !== null && sameAuthority(authority, oidc.authority) });
+        registries.push({
+          registry,
+          useOidc: oidc !== null && sameAuthority(authority, oidc.authority)
+        });
       } catch (exc) {
         if (!(exc instanceof CeError))
           throw exc;
@@ -1309,6 +2797,17 @@ async function login() {
         targets.push({ registry, label, user, password, useOidc });
     }
   }
+  if (dryRun) {
+    const available = engines.find((candidate) => system.which(candidate));
+    const selected = available ?? engines[0];
+    if (!available)
+      logError(`ce: warning: ${selected} is not on PATH, so running this here would fail`);
+    for (const target of targets) {
+      io.stdout(`${[selected, "login", "-u", target.user, "--password-stdin", target.registry].map(shellQuote).join(" ")}
+`);
+    }
+    return failed ? 1 : 0;
+  }
   let jwt = null;
   if (oidc && targets.some((target) => target.useOidc)) {
     try {
@@ -1329,14 +2828,14 @@ async function login() {
       continue;
     }
     log(`Logging in to ${registry} (${label})...`);
-    const engine = loginWithEngines(target, password);
-    if (!engine) {
+    const used = loginWithEngines(target, password, engines);
+    if (!used) {
       logError(`Login failed for '${label}' (${registry})`);
       failed = true;
       continue;
     }
-    log(`Logged in to ${registry} (${label}) via ${engine} ` + `(and all engines at or below it: docker < podman < buildah share credentials)`);
-    if (target.useOidc && oidc && jwt) {
+    log(`Logged in to ${registry} (${label}) via ${used}`);
+    if (target.useOidc && oidc && jwt && (!engine || engine === "docker")) {
       try {
         await configureDockerCredentialHelper(registry, target.user, oidc.audience, oidc.authority, jwt);
       } catch (exc) {
@@ -1350,11 +2849,771 @@ async function login() {
   return failed ? 1 : 0;
 }
 
+// src/options.ts
+function defaultOptions() {
+  return {
+    tagPrefix: process.env.TAG_PREFIX ?? "",
+    cachePrefix: process.env.CACHE_PREFIX ?? process.env.TAG_PREFIX ?? "",
+    tagLists: new Map,
+    used: new Map
+  };
+}
+function validateScope(options, tool) {
+  for (const [flag, scope] of options.used) {
+    if (isEngine(tool) !== (scope === "container"))
+      throw new CeError(`ce: ${flag} is a ${scope} option and cannot be used with ${tool}`);
+  }
+}
+function parseCeOptions(given, options, tool) {
+  let argv = given;
+  const use = (flag, scope) => {
+    options.used.set(flag, scope);
+    if (tool)
+      validateScope(options, tool);
+  };
+  const value = (flag) => {
+    const current = argv[0];
+    if (current === flag) {
+      const [result, rest] = consumeValue(argv.slice(1), flag);
+      argv = rest;
+      return result;
+    }
+    argv = argv.slice(1);
+    return current.slice(flag.length + 1);
+  };
+  for (;; ) {
+    const arg = argv[0];
+    if (arg === "--")
+      return { args: argv.slice(1), native: true };
+    if (arg === "--tag-list" || arg?.startsWith("--tag-list=")) {
+      use("--tag-list", "container");
+      defineTagList(value("--tag-list"), options.tagLists);
+    } else if (arg === "--tag-prefix" || arg?.startsWith("--tag-prefix=")) {
+      use("--tag-prefix", "container");
+      options.tagPrefix = value("--tag-prefix");
+    } else if (arg === "--cache-prefix" || arg?.startsWith("--cache-prefix=")) {
+      use("--cache-prefix", "container");
+      options.cachePrefix = value("--cache-prefix");
+    } else if (arg === "--oci-labels" || arg === "--no-oci-labels") {
+      use(arg, "container");
+      options.ociLabels = arg === "--oci-labels";
+      argv = argv.slice(1);
+    } else if (arg === "--cache-from-default") {
+      use(arg, "container");
+      options.cacheFromDefault = true;
+      argv = argv.slice(1);
+    } else if (arg === "--stage") {
+      use(arg, "publishing");
+      options.stage = true;
+      argv = argv.slice(1);
+    } else if (arg === "--tolerate-republish") {
+      use(arg, "publishing");
+      options.tolerateRepublish = true;
+      argv = argv.slice(1);
+    } else if (arg === "--token-env" || arg?.startsWith("--token-env=")) {
+      use("--token-env", "publishing");
+      options.tokenEnv = value("--token-env");
+    } else if (arg === "--forgejo-oidc") {
+      use(arg, "publishing");
+      options.forgejoOidc = true;
+      argv = argv.slice(1);
+    } else if (arg === "--tag-env" || arg?.startsWith("--tag-env=")) {
+      use("--tag-env", "publishing");
+      options.tagEnv = value("--tag-env");
+    } else if (arg === "--version-tag-env" || arg?.startsWith("--version-tag-env=")) {
+      use("--version-tag-env", "publishing");
+      options.versionTagEnv = value("--version-tag-env");
+    } else if (arg === "--pack-output-env" || arg?.startsWith("--pack-output-env=")) {
+      use("--pack-output-env", "publishing");
+      options.packOutputEnv = value("--pack-output-env");
+    } else if (arg === "--check-auth" || arg === "--no-check-auth") {
+      use(arg, "publishing");
+      options.checkAuth = arg === "--check-auth";
+      argv = argv.slice(1);
+    } else if (arg === "--auto-tag" || arg === "--no-auto-tag") {
+      use(arg, "publishing");
+      options.autoTag = arg === "--auto-tag";
+      argv = argv.slice(1);
+    } else if (arg === "--dry-run") {
+      options.dryRun = true;
+      argv = argv.slice(1);
+    } else
+      return { args: argv, native: false };
+  }
+}
+
+// src/publish.ts
+import path7 from "node:path";
+
+// src/npm-auth.ts
+function registryUrl(registry) {
+  if (!registry)
+    throw new CeError("ce: token authentication requires an explicit native --registry");
+  let url;
+  try {
+    url = new URL(registry);
+    if (!["http:", "https:"].includes(url.protocol) || !url.hostname || url.username || url.password || url.search || url.hash || /[\u0000-\u0020\\=]/u.test(registry))
+      throw new Error("invalid registry");
+  } catch {
+    throw new CeError("ce: token authentication requires an absolute HTTP(S) registry URL without credentials, query, fragment, whitespace, backslashes or equals signs");
+  }
+  if (!url.pathname.endsWith("/"))
+    url.pathname += "/";
+  return url;
+}
+function credentials(url, token) {
+  return {
+    registry: url.href,
+    env: { [`npm_config_//${url.host}${url.pathname}:_authToken`]: token },
+    token
+  };
+}
+function npmAuth(registry, tokenEnv, preview) {
+  if (!/^[A-Za-z_][A-Za-z\d_]*$/u.test(tokenEnv))
+    throw new CeError("ce: --token-env requires an environment variable name");
+  const url = registryUrl(registry);
+  const token = preview ? "" : process.env[tokenEnv];
+  if (!preview && (!token || /[\s\p{Cc}]/u.test(token)))
+    throw new CeError(`ce: ${tokenEnv} must contain a nonempty npm token without control characters`);
+  return credentials(url, token ?? "");
+}
+function forgejoNpmRegistry() {
+  const ci = (name) => process.env[`FORGEJO_${name}`] || process.env[`GITHUB_${name}`];
+  const server = ci("SERVER_URL");
+  const owner = ci("REPOSITORY_OWNER") || ci("REPOSITORY")?.split("/")[0];
+  if (!server || !owner)
+    throw new CeError("ce: --forgejo-oidc needs a native --registry outside a Forgejo Actions run; FORGEJO_SERVER_URL and FORGEJO_REPOSITORY are not set");
+  return `${server.replace(/\/+$/u, "")}/api/packages/${encodeURIComponent(owner)}/npm/`;
+}
+async function forgejoNpmAuth(registry, preview) {
+  const url = registryUrl(registry);
+  const audience = process.env.AUD;
+  const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
+  const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+  if (!audience || !requestUrl || !preview && !requestToken)
+    throw new CeError("ce: Forgejo npm OIDC requires AUD, ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN; enable-openid-connect must be enabled for the job");
+  try {
+    const request = new URL(requestUrl);
+    if (request.username || request.password || request.origin !== url.origin)
+      throw new Error("different server");
+  } catch {
+    throw new CeError("ce: Forgejo npm registry and OIDC token request must use the same HTTP(S) origin without URL credentials");
+  }
+  if (preview)
+    return credentials(url, "");
+  const token = await forgejoOidcJwt(audience, requestUrl, requestToken);
+  if (needsRefresh(jwtExpiry(token)))
+    throw new CeError("ce: Forgejo OIDC token expires within the five-minute window; refusing to publish");
+  return credentials(url, token);
+}
+
+// src/pack.ts
+import fs7 from "node:fs";
+import path6 from "node:path";
+
+// src/package-metadata.ts
+import fs6 from "node:fs";
+import path5 from "node:path";
+function readPackageManifest(file) {
+  let data;
+  try {
+    if (fs6.statSync(file).isDirectory())
+      data = readJsonFile(path5.join(file, "package.json"), undefined);
+    else {
+      const result = system.output([
+        "tar",
+        "-xOf",
+        file,
+        "package/package.json"
+      ]);
+      if (result.status !== 0)
+        throw new Error("cannot read package/package.json from tarball");
+      data = JSON.parse(result.stdout);
+    }
+  } catch (exc) {
+    throw new CeError(`ce: cannot read the publish target ${JSON.stringify(file)}: ${errorMessage(exc)}`);
+  }
+  if (!isObject(data))
+    throw new CeError("ce: the publish target has no package.json object");
+  return data;
+}
+function checkVersionTag(data, tag) {
+  const version = typeof data.version === "string" ? SEMVER.exec(data.version)?.[1] : undefined;
+  if (!version)
+    throw new CeError("ce: the selected package needs a valid SemVer version for release validation");
+  if (!tag)
+    return;
+  const name = tag.replace(/^refs\/tags\//u, "");
+  if (SEMVER.exec(name)?.[1] !== version)
+    throw new CeError(`ce: release tag ${JSON.stringify(tag)} does not match package version ${version}`);
+}
+
+// src/pack.ts
+function packWithMetadata(args, configArgs, options) {
+  const separator = args.indexOf("--");
+  const end = separator < 0 ? args.length : separator;
+  let printJson = false;
+  for (let i = 0;i < end; i++) {
+    if (args[i] === "--json")
+      printJson = args[i + 1] !== "false";
+    else if (args[i] === "--json=true")
+      printJson = true;
+    else if (args[i] === "--json=false" || args[i] === "--no-json")
+      printJson = false;
+  }
+  const native = [
+    ...args.slice(0, end),
+    "--json",
+    "--foreground-scripts=false",
+    ...args.slice(end)
+  ];
+  if (options.dryRun) {
+    if (!system.which("npm"))
+      logError("ce: warning: npm is not on PATH, so running this here would fail");
+    io.stdout(`${["npm", ...native].map(shellQuote).join(" ")}
+`);
+    return 0;
+  }
+  if (!system.which("npm")) {
+    logError("ce: npm not found on PATH");
+    return 1;
+  }
+  const config = system.capture([
+    "npm",
+    "config",
+    "list",
+    ...configArgs,
+    "--json"
+  ]);
+  io.stderr(config.stderr);
+  if (config.status !== 0) {
+    return config.status;
+  }
+  let settings;
+  try {
+    settings = JSON.parse(config.stdout);
+  } catch {
+    throw new CeError("ce: npm config did not return valid JSON");
+  }
+  if (!isObject(settings) || typeof settings["pack-destination"] !== "string" || !settings["pack-destination"] || /[\r\n\0]/u.test(settings["pack-destination"]))
+    throw new CeError("ce: npm config did not return a valid pack-destination");
+  if (settings["dry-run"] !== false)
+    throw new CeError("ce: package metadata requires a real tarball; use ce's --dry-run to preview");
+  if (settings.workspaces || Array.isArray(settings.workspace) && settings.workspace.length)
+    throw new CeError("ce: package metadata supports one package; select a package path instead of workspace mode");
+  const packed = system.capture(["npm", ...native]);
+  io.stderr(packed.stderr);
+  if (packed.status !== 0) {
+    io.stdout(packed.stdout);
+    return packed.status;
+  }
+  let report;
+  try {
+    report = JSON.parse(packed.stdout);
+  } catch {
+    throw new CeError("ce: npm pack did not return valid JSON");
+  }
+  const entries = Array.isArray(report) ? report : isObject(report) ? Object.values(report) : [];
+  const entry = entries[0];
+  if (entries.length !== 1 || !isObject(entry) || typeof entry.filename !== "string" || !entry.filename || path6.basename(entry.filename) !== entry.filename || /[\r\n\0]/u.test(entry.filename) || typeof entry.version !== "string" || !SEMVER.test(entry.version))
+    throw new CeError("ce: npm pack must report exactly one tarball with a valid filename and version");
+  const file = path6.resolve(settings["pack-destination"], entry.filename);
+  try {
+    if (!fs7.statSync(file).isFile())
+      throw new Error("not a regular file");
+  } catch {
+    throw new CeError("ce: npm pack did not produce the reported tarball file");
+  }
+  const manifest = readPackageManifest(file);
+  if (manifest.version !== entry.version)
+    throw new CeError("ce: npm pack metadata does not match the packed package version");
+  checkVersionTag(manifest, options.versionTag ?? "");
+  const tarball = path6.relative(process.cwd(), file);
+  if (/[\r\n\0]/u.test(tarball))
+    throw new CeError("ce: the tarball path cannot contain line breaks or null characters");
+  if (options.outputFile) {
+    try {
+      fs7.appendFileSync(options.outputFile, `tarball=${tarball}
+version=${entry.version}
+`);
+    } catch (exc) {
+      throw new CeError(`ce: cannot append package outputs: ${errorMessage(exc)}`);
+    }
+    logError(`ce: packed ${tarball} (${entry.version})`);
+  } else if (printJson)
+    io.stdout(packed.stdout);
+  else
+    io.stdout(`${entry.filename}
+`);
+  return 0;
+}
+
+// src/publish.ts
+function isPackageManager(value) {
+  return value === "npm" || value === "bun";
+}
+var VALUES = new Set([
+  "--tag",
+  "--access",
+  "--registry",
+  "--otp",
+  "--auth-type",
+  "--userconfig",
+  "--globalconfig",
+  "--cache",
+  "--cafile",
+  "--ca",
+  "--prefix",
+  "--workspace",
+  "-w",
+  "--filter",
+  "-F",
+  "--config",
+  "-c",
+  "--cwd",
+  "--env-file",
+  "--gzip-level",
+  "--provenance-file",
+  "--loglevel",
+  "--logs-dir",
+  "--cache-dir",
+  "--backend",
+  "--concurrent-scripts",
+  "--network-concurrency",
+  "--omit",
+  "--cpu",
+  "--os",
+  "--libc",
+  "--token-env",
+  "--tag-env",
+  "--version-tag-env",
+  "--pack-output-env",
+  "--pack-destination"
+]);
+var SWITCHES = new Set([
+  "--dry-run",
+  "--ignore-scripts",
+  "--foreground-scripts",
+  "--json",
+  "--provenance",
+  "--workspaces",
+  "--include-workspace-root",
+  "--force",
+  "-f",
+  "--silent",
+  "--quiet",
+  "--verbose",
+  "--frozen-lockfile",
+  "--offline",
+  "--prefer-offline",
+  "--lockfile-only",
+  "--trust",
+  "--global",
+  "-g",
+  "--yes",
+  "-y",
+  "--yarn",
+  "--production",
+  "-p",
+  "--recursive",
+  "-r",
+  "--tolerate-republish",
+  "--save",
+  "--use-system-ca",
+  "--use-openssl-ca",
+  "--use-bundled-ca"
+]);
+var WORKSPACES = new Set([
+  "--workspace",
+  "-w",
+  "--workspaces",
+  "--filter",
+  "-F",
+  "--recursive",
+  "-r"
+]);
+var CE_FLAGS = new Set([
+  "--stage",
+  "--tolerate-republish",
+  "--auto-tag",
+  "--no-auto-tag",
+  "--token-env",
+  "--check-auth",
+  "--no-check-auth",
+  "--forgejo-oidc",
+  "--tag-env",
+  "--version-tag-env",
+  "--pack-output-env"
+]);
+var AUTH_CONFIG = new Set([
+  "--userconfig",
+  "--globalconfig",
+  "--cafile",
+  "--ca",
+  "--cache",
+  "--prefix",
+  "--loglevel",
+  "--logs-dir",
+  "--use-system-ca",
+  "--use-openssl-ca",
+  "--use-bundled-ca"
+]);
+var PORTABLE_STAGE = new Set([
+  "--tag",
+  "--access",
+  "--registry",
+  "--otp",
+  "--auth-type",
+  "--dry-run",
+  "--ignore-scripts",
+  "--silent",
+  "--verbose",
+  "--json",
+  "--provenance",
+  "--provenance-file",
+  "--no-provenance",
+  "--ca",
+  "--cafile",
+  "--userconfig",
+  "--globalconfig",
+  "--help",
+  "-h",
+  "--version"
+]);
+function option(arg) {
+  return arg.split("=", 1)[0];
+}
+function knownOption(arg) {
+  return VALUES.has(option(arg)) || SWITCHES.has(option(arg)) || arg.startsWith("--no-") || arg.includes("=");
+}
+function parseNative(args) {
+  const parsed = { options: [], words: [], rest: [] };
+  for (let i = 0;i < args.length; ) {
+    const arg = args[i];
+    if (arg === "--") {
+      parsed.rest = args.slice(i + 1);
+      break;
+    }
+    if (!arg.startsWith("-")) {
+      parsed.words.push({ value: arg, index: i });
+      i++;
+      continue;
+    }
+    const name = option(arg);
+    const joined = arg.includes("=");
+    const takesValue = VALUES.has(name) && !joined;
+    const missing = takesValue && (!args[i + 1] || args[i + 1].startsWith("-"));
+    const end = takesValue && !missing ? i + 2 : i + 1;
+    parsed.options.push({
+      arg,
+      name,
+      joined,
+      value: joined ? arg.slice(name.length + 1) : end > i + 1 ? args[i + 1] : undefined,
+      known: knownOption(arg),
+      missing,
+      start: i,
+      end
+    });
+    i = end;
+  }
+  return parsed;
+}
+function requireValue(o) {
+  if (o.missing)
+    throw new CeError(`ce: ${o.arg} requires a value`);
+}
+function invocation(manager, args, parsed) {
+  const word = parsed.words[0];
+  for (const o of parsed.options) {
+    if (word && o.start > word.index)
+      break;
+    requireValue(o);
+    if (!o.known && !CE_FLAGS.has(o.name))
+      return;
+  }
+  if (!word)
+    return;
+  const i = word.index;
+  if (word.value === "publish" || manager === "npm" && word.value.length >= 2 && "publish".startsWith(word.value))
+    return { start: i, end: i + 1, staged: false, kind: "publish" };
+  if (manager === "npm" && word.value === "stage" && args[i + 1] === "publish")
+    return { start: i, end: i + 2, staged: true, kind: "publish" };
+  if (manager === "npm" && word.value === "pack")
+    return { start: i, end: i + 1, staged: false, kind: "pack" };
+  return;
+}
+function manifest(manager, parsed, command, validatingRelease = false) {
+  let cwd = process.cwd();
+  for (const { arg, name, value, known } of parsed.options) {
+    if (WORKSPACES.has(name) && !arg.endsWith("=false"))
+      throw new CeError(validatingRelease ? "ce: release validation requires one package; workspaces may have different versions" : "ce: workspace publishing needs an explicit --tag or --no-auto-tag; packages may have different versions");
+    if (name === "--prefix")
+      throw new CeError(validatingRelease ? "ce: release validation requires a local publish path instead of --prefix" : "ce: use a local publish path, --tag or --no-auto-tag with --prefix");
+    if (!known)
+      throw new CeError(validatingRelease ? `ce: release validation cannot determine the value syntax of ${name}; use an =value option` : `ce: cannot infer a tag with ${name}; pass --tag or --no-auto-tag`);
+    if (manager === "bun" && name === "--cwd")
+      cwd = path7.resolve(process.cwd(), value);
+  }
+  const targets = [
+    ...parsed.words.filter((word) => word.index >= command.end).map((word) => word.value),
+    ...parsed.rest
+  ];
+  if (targets.length > 1)
+    throw new CeError(validatingRelease ? "ce: release validation supports one local publish target" : "ce: tag inference supports one local publish target; pass --tag or --no-auto-tag");
+  const target = targets[0] ?? ".";
+  if (!target)
+    throw new CeError("ce: the publish target must not be empty");
+  if (/^[A-Za-z][A-Za-z\d+.-]*:/u.test(target) && !target.startsWith("file:"))
+    throw new CeError(validatingRelease ? "ce: release validation requires a local package directory or tarball" : "ce: automatic tags require a local package directory or tarball; pass --tag for other package specs");
+  const file = path7.resolve(cwd, target.replace(/^file:/u, ""));
+  return readPackageManifest(file);
+}
+function inferTag(data) {
+  if (isObject(data.publishConfig) && data.publishConfig.tag !== undefined)
+    return;
+  const version = typeof data.version === "string" ? SEMVER.exec(data.version) : null;
+  if (!version)
+    throw new CeError("ce: the publish target needs a valid SemVer version to infer a tag; use --tag to choose one explicitly");
+  const channel = version[5]?.split(".")[0];
+  if (channel && (channel === "latest" || /^(?:v?\d+|x)$/iu.test(channel)))
+    throw new CeError(`ce: prerelease ${JSON.stringify(data.version)} needs an explicit --tag; its first label is ambiguous or promotes latest`);
+  return channel;
+}
+function nativeConfig(args) {
+  const { options } = parseNative(args);
+  return {
+    registry: options.findLast((o) => o.name === "--registry"),
+    config: options.filter((o) => AUTH_CONFIG.has(o.name)).flatMap((o) => args.slice(o.start, o.end))
+  };
+}
+function registryQuery(argv, auth) {
+  if (!system.which("npm"))
+    throw new CeError("ce: --tolerate-republish needs npm on PATH to query the registry");
+  const result = system.capture(["npm", ...argv, "--json"], auth?.env);
+  let data;
+  try {
+    data = JSON.parse(result.stdout || "null");
+  } catch {
+    data = undefined;
+  }
+  if (result.status === 0)
+    return data ?? null;
+  if (isObject(data) && isObject(data.error) && data.error.code === "E404")
+    return;
+  let detail = (result.stderr || result.stdout).trim();
+  if (auth?.token)
+    detail = detail.replaceAll(auth.token, "[REDACTED]");
+  throw new CeError(`ce: --tolerate-republish could not query the registry with npm ${argv.slice(0, 2).join(" ")}: ${detail}`);
+}
+function releaseState({ name, version }, staged, config, auth) {
+  const published = registryQuery(["view", `${name}@${version}`, "version", ...config], auth);
+  if (Array.isArray(published) ? published.includes(version) : published === version)
+    return "published";
+  if (!staged)
+    return;
+  const items = registryQuery(["stage", "list", name, ...config], auth);
+  return Array.isArray(items) && items.some((item) => isObject(item) && item.version === version && String(item.status).toLowerCase() !== "rejected") ? "staged" : undefined;
+}
+function ciReleaseTag() {
+  try {
+    const vars = new CiMetadata;
+    return vars.get("version") === undefined ? "" : vars.get("tag");
+  } catch (exc) {
+    if (exc instanceof CeError)
+      return "";
+    throw exc;
+  }
+}
+function releaseTag(options) {
+  return options.versionTagEnv === undefined ? ciReleaseTag() : envValue(options.versionTagEnv, "--version-tag-env");
+}
+async function runPackageManager(manager, given, options = {}) {
+  const dryRun = options.dryRun ?? envFlag("CE_DRY_RUN");
+  const parsed = parseNative(given);
+  const selectedCommand = invocation(manager, given, parsed);
+  const command = selectedCommand?.kind === "publish" ? selectedCommand : undefined;
+  const pack = selectedCommand?.kind === "pack" ? selectedCommand : undefined;
+  if (options.stage && !command)
+    throw new CeError("ce: --stage requires npm publish or bun publish");
+  const staged = options.stage || command?.staged;
+  const client = staged ? "npm" : manager;
+  const help = given.some((arg) => ["--help", "-h", "--version"].includes(arg));
+  let args = given;
+  let release;
+  if (selectedCommand) {
+    for (const o of parsed.options) {
+      if (CE_FLAGS.has(o.name) && !(manager === "bun" && o.arg === "--tolerate-republish"))
+        throw new CeError(`ce: ${o.name} must immediately follow ${manager}, before its native arguments`);
+      requireValue(o);
+    }
+  }
+  if (!help) {
+    if (options.packOutputEnv !== undefined && !pack)
+      throw new CeError("ce: --pack-output-env requires npm pack");
+    if (options.tagEnv !== undefined && !command)
+      throw new CeError("ce: --tag-env requires npm publish or bun publish");
+    if (options.tolerateRepublish && !command)
+      throw new CeError("ce: --tolerate-republish requires npm publish or bun publish");
+    if (options.versionTagEnv !== undefined && !command && !pack)
+      throw new CeError("ce: --version-tag-env requires npm pack, npm publish or bun publish");
+  }
+  if (!help && pack && (options.packOutputEnv !== undefined || options.versionTagEnv !== undefined)) {
+    if (options.tokenEnv !== undefined || options.checkAuth !== undefined || options.forgejoOidc)
+      throw new CeError("ce: token authentication requires npm publish or bun --stage publish");
+    const outputFile = options.packOutputEnv === undefined ? undefined : envValue(options.packOutputEnv, "--pack-output-env");
+    if (outputFile !== undefined && !outputFile)
+      throw new CeError(`ce: ${options.packOutputEnv} must name a package output file`);
+    const versionTag = releaseTag(options);
+    const configArgs = [];
+    for (const o of parsed.options) {
+      if (WORKSPACES.has(o.name) && !o.arg.endsWith("=false"))
+        throw new CeError("ce: package metadata supports one package; select a package path instead of workspace mode");
+      if (!o.known)
+        throw new CeError(`ce: package metadata cannot determine the value syntax of ${o.name}; use an =value option`);
+      configArgs.push(...given.slice(o.start, o.end));
+    }
+    const targets = [
+      ...parsed.words.filter((word) => word.index !== pack.start).map((word) => word.value),
+      ...parsed.rest
+    ];
+    if (targets.length > 1 || targets.some((target) => !target))
+      throw new CeError("ce: package metadata requires one nonempty package target");
+    return packWithMetadata(given, configArgs, {
+      outputFile,
+      versionTag,
+      dryRun
+    });
+  }
+  if (command) {
+    const prefix = given.slice(0, command.start);
+    let body = given.slice(command.end);
+    if (staged && manager === "bun") {
+      const unsupported = parsed.options.find((o) => !PORTABLE_STAGE.has(o.name));
+      if (unsupported)
+        throw new CeError(`ce: --stage uses npm; ${unsupported.name} is not a supported npm staging option`);
+    }
+    const versionTag = help ? "" : releaseTag(options);
+    const explicitCheck = !help && options.versionTagEnv !== undefined;
+    let selectedManifest;
+    const metadata = () => selectedManifest ??= manifest(manager, parsed, command, explicitCheck);
+    if (explicitCheck)
+      checkVersionTag(metadata(), versionTag);
+    else if (versionTag) {
+      try {
+        selectedManifest = manifest(manager, parsed, command, true);
+      } catch (exc) {
+        if (!(exc instanceof CeError))
+          throw exc;
+        logError(`ce: warning: not checking the package version against ${versionTag}: ${exc.message.replace(/^ce: /u, "")}`);
+      }
+      if (selectedManifest)
+        checkVersionTag(selectedManifest, versionTag);
+    }
+    if (!help && options.tolerateRepublish && client === "bun") {
+      if (!body.includes("--tolerate-republish"))
+        body = ["--tolerate-republish", ...body];
+    } else if (!help && options.tolerateRepublish) {
+      try {
+        selectedManifest ??= manifest(manager, parsed, command, true);
+      } catch (exc) {
+        if (!(exc instanceof CeError))
+          throw exc;
+        throw new CeError(exc.message.replace(/^ce: release validation/u, "ce: --tolerate-republish"));
+      }
+      const { name, version } = selectedManifest;
+      if (typeof name !== "string" || !name || typeof version !== "string")
+        throw new CeError("ce: --tolerate-republish needs a package name and version");
+      const { publishConfig } = selectedManifest;
+      const registry = isObject(publishConfig) && typeof publishConfig.registry === "string" ? publishConfig.registry : undefined;
+      release = { name, version, registry };
+    }
+    let tagged = parsed.options.some((o) => o.name === "--tag");
+    if (!help && options.tagEnv !== undefined) {
+      const tag = envValue(options.tagEnv, "--tag-env");
+      if (tag && !tagged) {
+        body = [`--tag=${tag}`, ...body];
+        tagged = true;
+      }
+    }
+    if ((options.autoTag ?? true) && !help && !tagged && !(client === "npm" && (process.env.npm_config_tag || process.env.NPM_CONFIG_TAG))) {
+      const tag = inferTag(metadata());
+      if (tag)
+        body = [`--tag=${tag}`, ...body];
+    }
+    args = [
+      ...prefix,
+      ...staged ? ["stage", "publish"] : ["publish"],
+      ...body
+    ];
+  }
+  let auth;
+  const authConfig = [];
+  if (!help && (options.tokenEnv !== undefined || options.checkAuth !== undefined || options.forgejoOidc)) {
+    if (!command || client !== "npm")
+      throw new CeError("ce: token authentication requires npm publish or bun --stage publish");
+    if (options.tokenEnv !== undefined && options.forgejoOidc)
+      throw new CeError("ce: choose --token-env or --forgejo-oidc, not both");
+    if (options.tokenEnv === undefined && !options.forgejoOidc)
+      throw new CeError("ce: --check-auth and --no-check-auth require --token-env or --forgejo-oidc");
+    if (options.forgejoOidc && staged)
+      throw new CeError("ce: the Forgejo npm registry does not support staged publishing; use direct publish");
+    const native = nativeConfig(args);
+    const registry = native.registry;
+    authConfig.push(...native.config);
+    auth = options.forgejoOidc ? await forgejoNpmAuth(registry?.value ?? forgejoNpmRegistry(), dryRun) : npmAuth(registry?.value, options.tokenEnv, dryRun);
+    args = [...args];
+    if (registry)
+      args[registry.joined ? registry.start : registry.start + 1] = registry.joined ? `--registry=${auth.registry}` : auth.registry;
+    else {
+      const end = args.indexOf("--");
+      args.splice(end < 0 ? args.length : end, 0, `--registry=${auth.registry}`);
+    }
+  }
+  if (dryRun) {
+    if (!system.which(client))
+      logError(`ce: warning: ${client} is not on PATH, so running this here would fail`);
+    io.stdout(`${[client, ...args].map(shellQuote).join(" ")}
+`);
+    return 0;
+  }
+  if (auth && (options.checkAuth ?? !options.forgejoOidc)) {
+    if (!system.which("npm")) {
+      logError("ce: npm not found on PATH");
+      return 1;
+    }
+    const result = system.run(["npm", "whoami", ...authConfig, `--registry=${auth.registry}`], undefined, auth.env);
+    if (result.status !== 0) {
+      logError(`ce: npm authentication failed for ${auth.registry}`);
+      io.stderr(result.stderr.replaceAll(auth.token, "[REDACTED]"));
+      return result.status;
+    }
+  }
+  if (release) {
+    const native = nativeConfig(args);
+    const registry = native.registry?.value ?? release.registry;
+    const where = registry ? [...native.config, `--registry=${registry}`] : native.config;
+    const state = releaseState(release, staged, where, auth);
+    if (state) {
+      logError(`ce: ${release.name}@${release.version} is already ${state} on ${registry ?? "the configured registry"}; skipping`);
+      return 0;
+    }
+  }
+  return auth ? system.exec(client, [client, ...args], auth.env) : system.exec(client, [client, ...args]);
+}
+
 // src/cli.ts
 function helpText() {
-  return `Usage: ${io.argv0()} [--tag-prefix=<prefix>] [--cache-prefix=<prefix>] [--oci-labels] [command|engine] [args]
+  return `Usage: ${io.argv0()} <tool> [ce options] [--] [command] [args]
+       ${io.argv0()} [ce options] <tool|login> [args]
+
+Ce options immediately follow the tool and precede its native arguments.
+The before-tool form remains supported. -- explicitly ends ce option parsing.
 
-Options:
+Container options (docker, podman and buildah):
+    --tag-list=NAME=TEMPLATES
+                      Define a reusable comma/whitespace-separated tag list.
+                      Use {tags.NAME} as a whole entry after an image's colon.
+                      Repeat for different names; lists may reference lists.
     --tag-prefix=<prefix>
                       Prepend <prefix> to every tag passed via -t/--tag.
                       A trailing "-" is appended automatically if the prefix
@@ -1366,17 +3625,79 @@ Options:
                       --cache-from scopes stay shared. Defaults to the tag prefix
                       (TAG_PREFIX); set to "" to keep cache scopes shared.
                       Also available via CACHE_PREFIX environment variable.
-    --cache=<spec>    Shorthand for passing <spec> to both --cache-from and
-                      --cache-to. Supports the same forms as --cache-from/--cache-to.
-    --oci-labels      Add org.opencontainers.image.* labels (source, revision,
-                      version, title, description) from the Forgejo Actions
-                      run to builds. A --label with the same key wins.
-                      Also available via OCI_LABELS=true.
+    --cache-from-default
+                      Also read each gha --cache-to from its scope on the
+                      default branch, from the cache prefix as it is there,
+                      so a new branch or PR starts from its cache.
+                      Also available via CACHE_FROM_DEFAULT=true.
+    --no-oci-labels   Do not add the org.opencontainers.image.* labels and
+                      annotations (source, url, revision, version, title,
+                      description, created) that builds in a Forgejo Actions
+                      run otherwise get. A --label or --annotation with the
+                      same key wins over them.
+                      Also available via OCI_LABELS=false.
+Shared option:
+    --dry-run         Print the command without running the tool. For builds,
+                      include the summary and skipped tags and their guards.
+                      Template errors still exit 2;
+                      a missing tool is only a warning.
+                      Also available via CE_DRY_RUN=true.
+
+Publishing options (npm and bun):
+    --stage           Use npm stage publish instead of direct publishing.
+                      The bun form also uses npm; Bun is not required to stage.
+    --tolerate-republish
+                      Exit 0 without uploading when the version is already
+                      on the registry; with --stage, also when it is staged.
+                      Direct Bun publishing uses Bun's own option.
+    --auto-tag        Infer a prerelease dist-tag from its first label (default).
+    --no-auto-tag     Leave tag selection entirely to the package manager.
+                      Explicit --tag and publishConfig.tag take precedence.
+                      With npm, npm_config_tag/NPM_CONFIG_TAG also take precedence.
+                      Stable versions retain the native tag default and checks.
+    --token-env=NAME  Configure npm token authentication from an environment
+                      variable for this invocation. Requires native --registry.
+                      Supports npm and Bun staging; saves no credentials.
+    --forgejo-oidc    Fetch a Forgejo JWT using AUD and the Actions OIDC request
+                      variables. Requires npm direct publish; saves no
+                      credentials. No staging. --registry defaults to the
+                      repository owner's npm registry on this Forgejo server.
+    --no-check-auth   Skip the npm whoami check enabled by --token-env.
+    --check-auth      Enable that check (off by default for Forgejo).
+                      Requires --token-env or --forgejo-oidc.
+    --tag-env=NAME    Use a nonempty environment value as an explicit publish
+                      tag. Native --tag wins; empty/unset uses normal inference.
+    --version-tag-env=NAME
+                      Match the selected package version to this Git tag or
+                      refs/tags/ ref (optional v). Empty/unset skips comparison.
+                      Without it, a build of a SemVer tag such as v1.2.3
+                      checks against that tag. Applies to publish and
+                      metadata-enabled npm pack.
+    --pack-output-env=NAME
+                      Run npm pack with captured JSON and background lifecycle
+                      output, validate its tarball, and append tarball/version
+                      outputs to the file named by NAME (e.g. GITHUB_OUTPUT).
+    Examples:
+        ce npm --stage publish ./package.tgz
+        ce bun publish --tag next
+
+Container build shorthand (after build/bud):
+    --cache=<spec>    Pass <spec> to both --cache-from and --cache-to.
+                      A gha cache-from made this way leaves out mode=, which
+                      only applies to export. The same cache-from given twice
+                      is passed once.
 
 Placeholders, in build tags and in the tag and cache prefixes:
     {name}            The value of name; an error if it has none in this run.
     {?name}           Expands to nothing; leaves the tag out unless name has
-                      a value. Not allowed in prefixes.
+                      a value. In a prefix, leaves the prefix empty instead.
+    {!name}           Keeps the tag only when name has no value.
+    {?name=value}     Requires an exact, case-sensitive value match.
+    {?name|other}     Requires either condition; adjacent guards require both.
+                      {!...} negates the entire condition, including OR.
+                      Leading guards before an image apply to its whole -t.
+    {tags.NAME}       A --tag-list's entries; only after an image's colon,
+                      as a whole comma/whitespace-separated entry.
     {image}           Registry host and repository, lowercased
     {ref}             Branch name, pr-<number>, or tag name
     {branch} {pr} {tag}
@@ -1388,17 +3709,38 @@ Placeholders, in build tags and in the tag and cache prefixes:
                       From a SemVer tag such as v1.2.3 (v optional)
     {stable}          Set only for a SemVer tag without a pre-release
     {env.NAME}        The environment variable NAME
+    {arg.NAME}        The build arg NAME as the build gets it: from
+                      --build-arg, else the Containerfile's default for the
+                      stage built (--target's or the last)
+    A guard that does not pass leaves its tag out or its prefix empty even if
+    another guard there cannot be worked out.
     Values are made safe for a tag ("ci/x" becomes "ci-x"). Quote templates
     in single quotes. Example:
         -t '{image}:{ref},{?default}latest'
 
 Commands:
-    login             Log in to all available engines
+    <engine> login    Log in with that engine using REGISTRY_* and Forgejo OIDC.
+                      Arguments after login use native login instead; -- login
+                      also selects native login without arguments.
+    login             Legacy configured login, trying docker, podman, buildah.
 
-Engines:
+Tools:
     docker [args]     Passthrough to docker
-    podman [args]     Passthrough to podman (via gosu if available)
-    buildah [args]    Passthrough to buildah (via gosu if available)
+    podman [args]     Passthrough to podman
+    buildah [args]    Passthrough to buildah
+    npm [args]        Publish with inferred prerelease tags; otherwise passthrough
+    bun [args]        Publish with inferred prerelease tags; otherwise passthrough
+
+Environment variables (used by builds):
+    SBOM=true         Add an SBOM: with Docker, BuildKit's attestation; with
+                      podman and buildah, syft's SPDX, written into the image
+                      at /root/buildinfo/content_manifests/sbom.spdx.json.
+                      SBOM=spdx selects the same format. SBOM=cyclonedx uses
+                      syft's CycloneDX with podman and buildah, written as
+                      sbom.cdx.json in that directory. Docker refuses it.
+                      An engine SBOM option you pass takes precedence.
+                      A podman or buildah --sbom with no output gets an image
+                      path matching its preset.
 
 Environment variables (used by login):
     Each registry is a "group". The default group uses the bare variables
@@ -1428,35 +3770,35 @@ Environment variables (used by login):
 `;
 }
 async function main(argv) {
-  let ociLabels;
-  let tagPrefix = process.env.TAG_PREFIX ?? "";
-  let cachePrefix = process.env.CACHE_PREFIX ?? process.env.TAG_PREFIX ?? "";
-  for (;; ) {
-    const a = argv[0];
-    if (a === "--tag-prefix")
-      [tagPrefix, argv] = consumeValue(argv.slice(1), a);
-    else if (a?.startsWith("--tag-prefix="))
-      [tagPrefix, argv] = [a.slice("--tag-prefix=".length), argv.slice(1)];
-    else if (a === "--cache-prefix")
-      [cachePrefix, argv] = consumeValue(argv.slice(1), a);
-    else if (a?.startsWith("--cache-prefix="))
-      [cachePrefix, argv] = [a.slice("--cache-prefix=".length), argv.slice(1)];
-    else if (a === "--oci-labels")
-      [ociLabels, argv] = [true, argv.slice(1)];
-    else
-      break;
-  }
-  const [command, ...rest] = argv;
+  const options = defaultOptions();
+  const [command, ...rest] = parseCeOptions(argv, options).args;
   if (command === undefined) {
     io.stderr(helpText());
     return 0;
   }
-  if (command === "login")
-    return login();
+  if (command === "login") {
+    if (rest.length)
+      throw new CeError("ce: login takes no native arguments; use ce <engine> login, or place ce options before login");
+    if (options.used.has("--stage"))
+      throw new CeError("ce: --stage requires npm publish or bun publish");
+    if (options.tokenEnv !== undefined || options.checkAuth !== undefined || options.forgejoOidc)
+      throw new CeError("ce: token authentication requires npm publish or bun --stage publish");
+    if (options.tolerateRepublish || options.tagEnv !== undefined || options.versionTagEnv !== undefined || options.packOutputEnv !== undefined)
+      throw new CeError("ce: package preparation and release options require npm or bun");
+    return login(undefined, options.dryRun ?? envFlag("CE_DRY_RUN"));
+  }
   if (command === "credential-helper")
     return credentialHelper(rest);
-  if (isEngine(command))
-    return runEngine(command, rest, tagPrefix, cachePrefix, ociLabels);
+  if (isEngine(command) || isPackageManager(command)) {
+    validateScope(options, command);
+    const parsed = parseCeOptions(rest, options, command);
+    if (isEngine(command)) {
+      if (!parsed.native && parsed.args.length === 1 && parsed.args[0] === "login")
+        return login(command, options.dryRun ?? envFlag("CE_DRY_RUN"));
+      return runEngine(command, parsed.args, options.tagPrefix, options.cachePrefix, options);
+    }
+    return runPackageManager(command, parsed.args, options);
+  }
   io.stderr(helpText());
   return 1;
 }