@minnovate/shadow-publisher 0.11.4 → 0.11.7

package/dist/publisher.cjs

@@ -55,7 +55,9 @@ function ulid(now = Date.now()) {
   }
   const rnd = (0, import_node_crypto.randomBytes)(16);
   let rand = "";
-  for (let i = 0; i < 16; i++) rand += ALPHABET[rnd[i] % 32];
+  for (let i = 0; i < 16; i++) {
+    rand += ALPHABET[rnd[i] % 32];
+  }
   return timeChars.join("") + rand;
 }
 function newPublicationId() {
@@ -70,13 +72,19 @@ function canonicalJson(value) {
   return JSON.stringify(sortValue(value));
 }
 function sortValue(value) {
-  if (value === null || typeof value !== "object") return value;
-  if (Array.isArray(value)) return value.map(sortValue);
+  if (value === null || typeof value !== "object") {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map(sortValue);
+  }
   const obj = value;
   const out = {};
   for (const key of Object.keys(obj).sort()) {
     const v = obj[key];
-    if (v !== void 0) out[key] = sortValue(v);
+    if (v !== void 0) {
+      out[key] = sortValue(v);
+    }
   }
   return out;
 }
@@ -193,7 +201,9 @@ var PublisherError = class _PublisherError extends Error {
   }
   toBody() {
     const error2 = { code: this.code, message: this.message, retryable: this.retryable };
-    if (this.details) error2.details = this.details;
+    if (this.details) {
+      error2.details = this.details;
+    }
     return { error: error2 };
   }
   static isPublisherError(e) {
@@ -2988,10 +2998,17 @@ function sanitizedGitEnv(opts = {}) {
     GIT_NO_LAZY_FETCH: "1"
     // never let a parent process's git context leak into the child
   };
-  if (process.env["GIT_EXEC_PATH"]) env["GIT_EXEC_PATH"] = process.env["GIT_EXEC_PATH"];
-  if (process.env["GITPUB_GIT_TEMPLATE_DIR"] !== void 0) env["GIT_TEMPLATE_DIR"] = process.env["GITPUB_GIT_TEMPLATE_DIR"];
-  else env["GIT_TEMPLATE_DIR"] = "";
-  if (opts.extra) Object.assign(env, opts.extra);
+  if (process.env["GIT_EXEC_PATH"]) {
+    env["GIT_EXEC_PATH"] = process.env["GIT_EXEC_PATH"];
+  }
+  if (process.env["GITPUB_GIT_TEMPLATE_DIR"] !== void 0) {
+    env["GIT_TEMPLATE_DIR"] = process.env["GITPUB_GIT_TEMPLATE_DIR"];
+  } else {
+    env["GIT_TEMPLATE_DIR"] = "";
+  }
+  if (opts.extra) {
+    Object.assign(env, opts.extra);
+  }
   return env;
 }
 var GIT_BIN = process.env["GITPUB_GIT_BIN"] ?? "git";
@@ -3000,7 +3017,9 @@ function neutralCwd() {
 }
 function startFailure(label, error2, cwd) {
   const opts = { retryable: true, cause: error2 };
-  if (error2.code !== "ENOENT") return new PublisherError("UNAVAILABLE", `${label} could not be started: ${error2.message}`, opts);
+  if (error2.code !== "ENOENT") {
+    return new PublisherError("UNAVAILABLE", `${label} could not be started: ${error2.message}`, opts);
+  }
   if (!isDirectory(cwd)) {
     const which = cwd === (0, import_node_os.tmpdir)() ? "the temporary directory (TMPDIR)" : "its working directory";
     return new PublisherError("UNAVAILABLE", `${label} could not be started: ${which} ${cwd} does not exist`, { ...opts, details: { missing: "cwd", cwd } });
@@ -3050,21 +3069,31 @@ function clearTimersOf(lc) {
 function notifyWaiters(lc) {
   const ws = [...lc.waiters];
   lc.waiters.clear();
-  for (const w of ws) w();
+  for (const w of ws) {
+    w();
+  }
 }
 function markIgnored(child) {
-  if (childClosed(child)) return;
+  if (childClosed(child)) {
+    return;
+  }
   const lc = lifecycleOf(child);
-  if (lc.ignored) return;
+  if (lc.ignored) {
+    return;
+  }
   lc.ignored = true;
   clearTimersOf(lc);
   notifyWaiters(lc);
 }
 function armCloseBound(child, boundMs) {
   const lc = lifecycleOf(child);
-  if (childClosed(child) || lc.ignored) return;
+  if (childClosed(child) || lc.ignored) {
+    return;
+  }
   const deadline = Date.now() + boundMs;
-  if (lc.boundTimer && deadline >= lc.boundDeadline) return;
+  if (lc.boundTimer && deadline >= lc.boundDeadline) {
+    return;
+  }
   if (lc.boundTimer) {
     clearTimeout(lc.boundTimer);
     lc.timers.delete(lc.boundTimer);
@@ -3085,7 +3114,9 @@ function track(child, boundMs = CLEANUP_BOUND_MS) {
   const lc = lifecycleOf(child);
   lc.boundMs = boundMs;
   child.on("error", (e) => {
-    if (lc.error === null) lc.error = e;
+    if (lc.error === null) {
+      lc.error = e;
+    }
   });
   child.once("close", () => {
     closedChildren.add(child);
@@ -3101,7 +3132,9 @@ var defaultSignalGroup = (pid, signal) => process.kill(-pid, signal);
 var spawnImpl = import_node_child_process.spawn;
 var signalGroupImpl = defaultSignalGroup;
 function spawnFailure(child) {
-  if (child.pid !== void 0) return null;
+  if (child.pid !== void 0) {
+    return null;
+  }
   const e = lifecycles.get(child)?.error;
   return e instanceof Error ? e : e ? new Error(String(e)) : null;
 }
@@ -3109,9 +3142,13 @@ function childExited(child) {
   return child.exitCode !== null || child.signalCode !== null;
 }
 function closeOrIgnored(child) {
-  if (childClosed(child)) return Promise.resolve(true);
+  if (childClosed(child)) {
+    return Promise.resolve(true);
+  }
   const lc = lifecycleOf(child);
-  if (lc.ignored) return Promise.resolve(false);
+  if (lc.ignored) {
+    return Promise.resolve(false);
+  }
   return new Promise((resolve3) => {
     lc.waiters.add(() => resolve3(childClosed(child)));
   });
@@ -3126,16 +3163,22 @@ function childClosed(child) {
 }
 function killAllGitProcesses() {
   const n = liveChildren.size;
-  for (const child of liveChildren) killProcessGroup(child);
+  for (const child of liveChildren) {
+    killProcessGroup(child);
+  }
   return n;
 }
 function killProcessGroup(child) {
-  if (child.pid === void 0 || childClosed(child)) return;
+  if (child.pid === void 0 || childClosed(child)) {
+    return;
+  }
   signalChildGroup(child, "SIGKILL");
 }
 function signalChildGroup(child, signal) {
   try {
-    if (child.pid === void 0) throw new Error("no pid");
+    if (child.pid === void 0) {
+      throw new Error("no pid");
+    }
     signalGroupImpl(child.pid, signal);
   } catch {
     try {
@@ -3145,19 +3188,29 @@ function signalChildGroup(child, signal) {
   }
 }
 function waitWithin(start, ms, stop) {
-  if (ms <= 0) return Promise.resolve({ status: "timeout" });
-  if (stop?.aborted) return Promise.resolve({ status: "stopped" });
+  if (ms <= 0) {
+    return Promise.resolve({ status: "timeout" });
+  }
+  if (stop?.aborted) {
+    return Promise.resolve({ status: "stopped" });
+  }
   const ac = new AbortController();
   return new Promise((resolve3) => {
     let timer = null;
     let done = false;
     const onStop = () => settle({ status: "stopped" });
     const settle = (r) => {
-      if (done) return;
+      if (done) {
+        return;
+      }
       done = true;
-      if (timer) clearTimeout(timer);
+      if (timer) {
+        clearTimeout(timer);
+      }
       stop?.removeEventListener("abort", onStop);
-      if (r.status !== "value" && r.status !== "error") ac.abort();
+      if (r.status !== "value" && r.status !== "error") {
+        ac.abort();
+      }
       resolve3(r);
     };
     let p;
@@ -3171,7 +3224,9 @@ function waitWithin(start, ms, stop) {
       (value) => settle({ status: "value", value }),
       (error2) => settle({ status: "error", error: error2 })
     );
-    if (done) return;
+    if (done) {
+      return;
+    }
     timer = setTimeout(() => settle({ status: "timeout" }), ms);
     timer.unref();
     stop?.addEventListener("abort", onStop, { once: true });
@@ -3179,8 +3234,12 @@ function waitWithin(start, ms, stop) {
 }
 function spawnTracked(args, opts) {
   for (const a of args) {
-    if (typeof a !== "string") throw new Error("git args must be strings");
-    if (a.includes("\0")) throw new PublisherError("INVALID_REQUEST", "NUL in git argument");
+    if (typeof a !== "string") {
+      throw new Error("git args must be strings");
+    }
+    if (a.includes("\0")) {
+      throw new PublisherError("INVALID_REQUEST", "NUL in git argument");
+    }
   }
   const cwd = opts.cwd ?? neutralCwd();
   const child = spawnImpl(GIT_BIN, args, { cwd, env: sanitizedGitEnv(opts.env), stdio: ["pipe", "pipe", "pipe"], windowsHide: true, detached: true });
@@ -3232,7 +3291,9 @@ function killedError(reason, detail, args, timeoutMs, maxOut) {
   }
 }
 async function runGit(args, opts = {}) {
-  if (opts.maxDiskBytes !== void 0 && !opts.diskDir) throw new Error("maxDiskBytes requires diskDir");
+  if (opts.maxDiskBytes !== void 0 && !opts.diskDir) {
+    throw new Error("maxDiskBytes requires diskDir");
+  }
   const started = Date.now();
   const timeoutMs = opts.timeoutMs ?? 12e4;
   const maxOut = opts.maxStdoutBytes ?? 64 * 1024 * 1024;
@@ -3245,7 +3306,9 @@ async function runGit(args, opts = {}) {
   let killedDetail = "";
   let closed = false;
   const kill = (reason, detail = "") => {
-    if (killedReason || closed) return;
+    if (killedReason || closed) {
+      return;
+    }
     killedReason = reason;
     killedDetail = detail;
     terminate(child);
@@ -3253,17 +3316,25 @@ async function runGit(args, opts = {}) {
   const timer = setTimeout(() => kill("timeout"), timeoutMs);
   const onAbort = () => kill("cancelled");
   if (opts.signal) {
-    if (opts.signal.aborted) onAbort();
-    else opts.signal.addEventListener("abort", onAbort, { once: true });
+    if (opts.signal.aborted) {
+      onAbort();
+    } else {
+      opts.signal.addEventListener("abort", onAbort, { once: true });
+    }
   }
   const watchdog = startWatchdog(child, opts, kill, () => closed);
   child.stdout.on("data", (c) => {
     outBytes += c.length;
-    if (outBytes > maxOut) kill("output-limit");
-    else stdoutChunks.push(c);
+    if (outBytes > maxOut) {
+      kill("output-limit");
+    } else {
+      stdoutChunks.push(c);
+    }
   });
   child.stderr.on("data", (c) => {
-    if (stderr.length < 64 * 1024) stderr += c.toString("utf8");
+    if (stderr.length < 64 * 1024) {
+      stderr += c.toString("utf8");
+    }
   });
   const stdin = feedStdin(child, opts.input, () => kill("input-error"));
   const ended = await endedOrIgnored(child).finally(() => {
@@ -3285,14 +3356,24 @@ async function runGit(args, opts = {}) {
   const code = ended.code;
   const result = { code, stdout: Buffer.concat(stdoutChunks), stderr, durationMs };
   const cleanup = await reapChild(child, { boundMs: cleanupBoundMs, ...opts.groupObserver ? { observer: opts.groupObserver } : {} });
-  if (!reapSucceeded(cleanup)) throw cleanupFailure(`git ${args[0]}`, cleanup, killedReason ?? void 0);
-  if (ended.error) throw startFailure(`git ${args[0]}`, ended.error, cwd);
-  if (killedReason) throw killedError(killedReason, killedDetail, args, timeoutMs, maxOut);
-  if (code !== 0 && !opts.allowFailure) throw new GitCommandError(args, code, stderr, opts.label);
+  if (!reapSucceeded(cleanup)) {
+    throw cleanupFailure(`git ${args[0]}`, cleanup, killedReason ?? void 0);
+  }
+  if (ended.error) {
+    throw startFailure(`git ${args[0]}`, ended.error, cwd);
+  }
+  if (killedReason) {
+    throw killedError(killedReason, killedDetail, args, timeoutMs, maxOut);
+  }
+  if (code !== 0 && !opts.allowFailure) {
+    throw new GitCommandError(args, code, stderr, opts.label);
+  }
   return result;
 }
 function startWatchdog(child, opts, kill, isClosed) {
-  if (opts.maxMemoryBytes === void 0 && opts.maxDiskBytes === void 0) return { stop: () => void 0, done: Promise.resolve() };
+  if (opts.maxMemoryBytes === void 0 && opts.maxDiskBytes === void 0) {
+    return { stop: () => void 0, done: Promise.resolve() };
+  }
   const sampler = opts.sampler ?? defaultResourceSampler;
   const interval2 = Math.max(10, opts.sampleIntervalMs ?? 500);
   const sampleBoundMs = opts.cleanupBoundMs ?? CLEANUP_BOUND_MS;
@@ -3311,10 +3392,17 @@ function startWatchdog(child, opts, kill, isClosed) {
   });
   const sample = async (what, start) => {
     const r = await waitWithin(start, sampleBoundMs, stopper.signal);
-    if (isClosed() || stopped) return null;
-    if (r.status === "value") return r.value;
-    if (r.status === "error") kill("monitor", `resource monitor failed: ${r.error.message}`);
-    else kill("monitor", `resource sample (${what}) did not complete within ${sampleBoundMs}ms`);
+    if (isClosed() || stopped) {
+      return null;
+    }
+    if (r.status === "value") {
+      return r.value;
+    }
+    if (r.status === "error") {
+      kill("monitor", `resource monitor failed: ${r.error.message}`);
+    } else {
+      kill("monitor", `resource sample (${what}) did not complete within ${sampleBoundMs}ms`);
+    }
     return null;
   };
   const done = (async () => {
@@ -3325,10 +3413,14 @@ function startWatchdog(child, opts, kill, isClosed) {
     let tick = 0;
     while (!stopped) {
       await sleep2(interval2);
-      if (stopped) return;
+      if (stopped) {
+        return;
+      }
       if (opts.maxMemoryBytes !== void 0) {
         const rss = await sample("memory", (signal) => sampler.groupRss(pgid, signal));
-        if (rss === null) return;
+        if (rss === null) {
+          return;
+        }
         if (rss > opts.maxMemoryBytes) {
           kill("memory", `process group uses ${rss} bytes of memory; limit ${opts.maxMemoryBytes}`);
           return;
@@ -3337,7 +3429,9 @@ function startWatchdog(child, opts, kill, isClosed) {
       if (opts.maxDiskBytes !== void 0 && opts.diskDir && tick % 2 === 1) {
         const dir = opts.diskDir;
         const bytes = await sample("disk", (signal) => sampler.dirBytes(dir, signal));
-        if (bytes === null) return;
+        if (bytes === null) {
+          return;
+        }
         if (bytes > opts.maxDiskBytes) {
           kill("disk", `scratch directory holds ${bytes} bytes; limit ${opts.maxDiskBytes}`);
           return;
@@ -3356,17 +3450,25 @@ async function scanProcessGroup(pgid, signal) {
   const members2 = [];
   if (process.platform === "linux") {
     for (const name of await (0, import_promises.readdir)("/proc")) {
-      if (signal?.aborted) throw new Error("process-group scan abandoned by its caller");
-      if (!/^\d+$/.test(name)) continue;
+      if (signal?.aborted) {
+        throw new Error("process-group scan abandoned by its caller");
+      }
+      if (!/^\d+$/.test(name)) {
+        continue;
+      }
       try {
         const stat4 = await (0, import_promises.readFile)(`/proc/${name}/stat`, "utf8");
         const rest = stat4.slice(stat4.lastIndexOf(")") + 2).split(" ");
-        if (Number(rest[2]) !== pgid) continue;
+        if (Number(rest[2]) !== pgid) {
+          continue;
+        }
         const status = await (0, import_promises.readFile)(`/proc/${name}/status`, "utf8");
         members2.push({ pid: Number(name), rss: Number(/^VmRSS:\s+(\d+)/m.exec(status)?.[1] ?? 0) * 1024 });
       } catch (e) {
         const code = e.code;
-        if (code === "ENOENT" || code === "ESRCH") continue;
+        if (code === "ENOENT" || code === "ESRCH") {
+          continue;
+        }
         throw e;
       }
     }
@@ -3380,7 +3482,9 @@ async function scanProcessGroup(pgid, signal) {
     });
     for (const line of stdout.split("\n")) {
       const [g, pid, rss] = line.trim().split(/\s+/);
-      if (Number(g) === pgid) members2.push({ pid: Number(pid), rss: Number(rss) * 1024 });
+      if (Number(g) === pgid) {
+        members2.push({ pid: Number(pid), rss: Number(rss) * 1024 });
+      }
     }
     return members2;
   }
@@ -3390,7 +3494,9 @@ async function processGroupRss(pgid, signal) {
   return (await scanProcessGroup(pgid, signal)).reduce((sum, m) => sum + m.rss, 0);
 }
 async function processGroupMembers(pgid, signal) {
-  if (!groupMayHaveMembers(pgid)) return [];
+  if (!groupMayHaveMembers(pgid)) {
+    return [];
+  }
   return (await scanProcessGroup(pgid, signal)).map((m) => m.pid);
 }
 function groupMayHaveMembers(pgid) {
@@ -3405,23 +3511,30 @@ async function directoryBytes(dir, signal) {
   let total = 0;
   const stack = [dir];
   while (stack.length) {
-    if (signal?.aborted) throw new Error("directory scan abandoned by its caller");
+    if (signal?.aborted) {
+      throw new Error("directory scan abandoned by its caller");
+    }
     const d = stack.pop();
     let entries;
     try {
       entries = await (0, import_promises.readdir)(d, { withFileTypes: true });
     } catch (e) {
-      if (e.code === "ENOENT") continue;
+      if (e.code === "ENOENT") {
+        continue;
+      }
       throw e;
     }
     for (const ent of entries) {
       const p = (0, import_node_path.join)(d, ent.name);
-      if (ent.isDirectory()) stack.push(p);
-      else if (ent.isFile()) {
+      if (ent.isDirectory()) {
+        stack.push(p);
+      } else if (ent.isFile()) {
         try {
           total += (await (0, import_promises.lstat)(p)).size;
         } catch (e) {
-          if (e.code !== "ENOENT") throw e;
+          if (e.code !== "ENOENT") {
+            throw e;
+          }
         }
       }
     }
@@ -3454,7 +3567,9 @@ function spawnGit(args, opts = {}) {
     child,
     opts,
     (reason) => {
-      if (killed || closed) return;
+      if (killed || closed) {
+        return;
+      }
       killed = reason;
       terminate(child);
     },
@@ -3466,25 +3581,38 @@ function spawnGit(args, opts = {}) {
 }
 function terminate(child, opts = {}) {
   const lc = lifecycleOf(child);
-  if (childClosed(child) || lc.ignored) return;
+  if (childClosed(child) || lc.ignored) {
+    return;
+  }
   const boundMs = opts.boundMs ?? lc.boundMs;
   armCloseBound(child, boundMs);
-  if (lc.terminated) return;
+  if (lc.terminated) {
+    return;
+  }
   lc.terminated = true;
   const drain = () => {
-    for (const stream of [child.stdout, child.stderr]) stream?.resume();
+    for (const stream of [child.stdout, child.stderr]) {
+      stream?.resume();
+    }
   };
-  if (childExited(child)) drain();
-  else child.once("exit", drain);
+  if (childExited(child)) {
+    drain();
+  } else {
+    child.once("exit", drain);
+  }
   killProcessGroup(child);
-  if (!childClosed(child)) scheduleFor(child, () => killProcessGroup(child), 250, true);
+  if (!childClosed(child)) {
+    scheduleFor(child, () => killProcessGroup(child), 250, true);
+  }
 }
 async function reapChild(child, opts = {}) {
   const boundMs = opts.boundMs ?? lifecycleOf(child).boundMs;
   const deadline = Date.now() + boundMs;
   let timedOut = false;
   if (!childClosed(child)) {
-    if (!lifecycleOf(child).ignored) terminate(child, { boundMs });
+    if (!lifecycleOf(child).ignored) {
+      terminate(child, { boundMs });
+    }
     timedOut = !await closeOrIgnored(child);
   }
   let groupCleared = true;
@@ -3501,17 +3629,23 @@ async function reapChild(child, opts = {}) {
         break;
       }
       if (r.status !== "value") {
-        if (!observed) groupCleared = null;
+        if (!observed) {
+          groupCleared = null;
+        }
         timedOut = true;
         break;
       }
       observed = true;
       survivors = r.value;
       groupCleared = survivors.length === 0;
-      if (groupCleared || !childClosed(child) || Date.now() >= deadline) break;
+      if (groupCleared || !childClosed(child) || Date.now() >= deadline) {
+        break;
+      }
       await new Promise((resolve3) => setTimeout(resolve3, Math.min(25, deadline - Date.now())));
     }
-    if (groupCleared === false) timedOut = true;
+    if (groupCleared === false) {
+      timedOut = true;
+    }
   }
   return { closed: childClosed(child), groupCleared, timedOut, survivors };
 }
@@ -3521,7 +3655,9 @@ function reapSucceeded(outcome) {
 function cleanupFailure(what, outcome, cause) {
   const why = !outcome.closed ? "the process did not close within the cleanup bound" : outcome.groupCleared === null ? "its process group could not be observed" : `its process group still has ${outcome.survivors.length} member(s)`;
   const cleanup = { closed: outcome.closed, groupCleared: outcome.groupCleared, timedOut: outcome.timedOut, survivors: outcome.survivors };
-  if (typeof cause === "string") cleanup["preempted"] = cause;
+  if (typeof cause === "string") {
+    cleanup["preempted"] = cause;
+  }
   return new PublisherError("UNAVAILABLE", `${what}: ${why}`, {
     retryable: true,
     details: { cleanup },
@@ -3530,10 +3666,14 @@ function cleanupFailure(what, outcome, cause) {
 }
 var cachedVersion = null;
 async function gitVersion() {
-  if (cachedVersion) return cachedVersion;
+  if (cachedVersion) {
+    return cachedVersion;
+  }
   const { stdout } = await execFileP(GIT_BIN, ["--version"], { env: sanitizedGitEnv(), timeout: 3e4 });
   const m = /git version (\d+\.\d+\.\d+)/.exec(stdout);
-  if (!m) throw new PublisherError("GIT", `cannot parse git version: ${stdout.trim()}`);
+  if (!m) {
+    throw new PublisherError("GIT", `cannot parse git version: ${stdout.trim()}`);
+  }
   cachedVersion = m[1];
   return cachedVersion;
 }
@@ -3542,7 +3682,9 @@ function compareVersions(a, b) {
   const pb = b.split(".").map(Number);
   for (let i = 0; i < 3; i++) {
     const d = (pa[i] ?? 0) - (pb[i] ?? 0);
-    if (d !== 0) return d;
+    if (d !== 0) {
+      return d;
+    }
   }
   return 0;
 }
@@ -3562,7 +3704,9 @@ async function sha256File(path) {
     }).on("error", reject).on("end", () => resolve3());
   });
   const st = await (0, import_promises2.stat)(path);
-  if (st.size !== size) throw new Error("file changed while hashing");
+  if (st.size !== size) {
+    throw new Error("file changed while hashing");
+  }
   return { sha256: h.digest("hex"), size };
 }
 
@@ -3570,32 +3714,47 @@ async function sha256File(path) {
 var import_node_fs3 = require("node:fs");
 async function indexPackFromFile(dir, packPath, opts = {}) {
   const args = ["index-pack", "--stdin", ...opts.keep ?? true ? ["--keep=gitpub"] : []];
-  if (opts.strict ?? true) args.push("--strict", "--fsck-objects");
-  if (opts.maxInputBytes) args.push(`--max-input-size=${opts.maxInputBytes}`);
+  if (opts.strict ?? true) {
+    args.push("--strict", "--fsck-objects");
+  }
+  if (opts.maxInputBytes) {
+    args.push(`--max-input-size=${opts.maxInputBytes}`);
+  }
   const run = { cwd: dir, input: (0, import_node_fs3.createReadStream)(packPath), label: "index-pack", ...opts };
   const res = await runGit(args, { ...run, allowFailure: true });
   if (res.code !== 0) {
     const msg = res.stderr.trim().split("\n").pop() ?? "index-pack failed";
     const missing = /did not receive expected object|not a valid|missing/i.test(res.stderr);
     const environment = /No space left|Permission denied|Input\/output error|cannot open|unable to (?:open|read|create|write)|Cannot allocate memory|Too many open files|Killed/i.test(res.stderr);
-    if (environment) throw new PublisherError("UNAVAILABLE", `index-pack failed: ${sanitizeGitMessage(msg)}`, { retryable: true });
+    if (environment) {
+      throw new PublisherError("UNAVAILABLE", `index-pack failed: ${sanitizeGitMessage(msg)}`, { retryable: true });
+    }
     throw new PublisherError(missing ? "MISSING_OBJECTS" : "PACK_INVALID", sanitizeGitMessage(msg));
   }
   const m = /^(?:pack|keep)\t([0-9a-f]{40,64})/m.exec(res.stdout.toString("utf8"));
-  if (!m) throw new PublisherError("PACK_INVALID", "index-pack produced no pack name");
+  if (!m) {
+    throw new PublisherError("PACK_INVALID", "index-pack produced no pack name");
+  }
   return { packName: m[1] };
 }
 function sanitizeGitMessage(msg) {
   return msg.replace(/\/[^\s:]+/g, "<path>").replace(/https?:\/\/\S+/g, "<url>").slice(0, 500);
 }
 async function refTransaction(dir, updates, opts = {}) {
-  if (updates.length === 0) return;
+  if (updates.length === 0) {
+    return;
+  }
   const lines = ["start"];
   for (const u of updates) {
-    if (u.ref.includes("\n") || u.ref.includes("\0")) throw new PublisherError("INVALID_REF_NAME", "newline in ref");
+    if (u.ref.includes("\n") || u.ref.includes("\0")) {
+      throw new PublisherError("INVALID_REF_NAME", "newline in ref");
+    }
     const oldPart = u.old === void 0 ? "" : ` ${u.old ?? "0".repeat(40)}`;
-    if (u.new === null) lines.push(`delete ${u.ref}${oldPart}`);
-    else lines.push(`update ${u.ref} ${u.new}${oldPart}`);
+    if (u.new === null) {
+      lines.push(`delete ${u.ref}${oldPart}`);
+    } else {
+      lines.push(`update ${u.ref} ${u.new}${oldPart}`);
+    }
   }
   lines.push("prepare", "commit", "");
   await runGit(["update-ref", "--stdin"], { cwd: dir, input: lines.join("\n"), label: "update-ref", ...opts });
@@ -3606,14 +3765,18 @@ async function batchCheck(dir, oids, opts = {}) {
   const { stdout } = await runGit(["cat-file", "--batch-check=%(objectname) %(objecttype) %(objectsize)"], run);
   const out = [];
   for (const line of stdout.toString("utf8").split("\n")) {
-    if (!line) continue;
+    if (!line) {
+      continue;
+    }
     const [oid, type, size] = line.split(" ");
     out.push({ oid, type: type ?? "missing", size: type === "missing" ? 0 : Number(size) });
   }
   return out;
 }
 async function resolveRev(dir, rev, peel) {
-  if (rev.startsWith("-")) return null;
+  if (rev.startsWith("-")) {
+    return null;
+  }
   const r = await runGit(["rev-parse", "--verify", "-q", peel ? `${rev}^{}` : rev], { cwd: dir, allowFailure: true });
   return r.code === 0 ? r.stdout.toString("utf8").trim() : null;
 }
@@ -3622,14 +3785,19 @@ async function resolveRevs(dir, revs, opts = {}) {
     (r) => r.startsWith("-") ? null : r.includes("\0") ? new PublisherError("INVALID_REQUEST", "NUL in git argument") : null
   );
   const ask4 = revs.flatMap((r, i) => out[i] === null && !r.startsWith("-") ? [i] : []);
-  if (ask4.length === 0) return out;
+  if (ask4.length === 0) {
+    return out;
+  }
   const { stdout } = await runGit(["cat-file", "--batch-check=%(objectname)", "-Z"], { cwd: dir, input: ask4.map((i) => revs[i]).join("\0") + "\0", ...opts });
   const records = stdout.toString("utf8").split("\0");
   const misses = [];
   for (const [j, i] of ask4.entries()) {
     const record2 = records[j] ?? "";
-    if (record2 && !/ (missing|ambiguous)$/.test(record2)) out[i] = record2;
-    else if (!revs[i].includes("^{")) misses.push(i);
+    if (record2 && !/ (missing|ambiguous)$/.test(record2)) {
+      out[i] = record2;
+    } else if (!revs[i].includes("^{")) {
+      misses.push(i);
+    }
   }
   await Promise.all(misses.map(async (i) => out[i] = await resolveRev(dir, revs[i], false)));
   return out;
@@ -3677,10 +3845,18 @@ async function packObjectsToFile(repoDir, extraArgs, stdinLines, opts) {
       }
     }
     const code = ended.code;
-    if (ended.error) throw startFailure("git pack-objects", ended.error, repoDir);
-    if (opts.signal?.aborted) throw new PublisherError("CANCELLED", "pack creation cancelled");
-    if (timedOut) throw new PublisherError("GIT", `pack-objects timed out after ${timeoutMs}ms`, { retryable: true });
-    if (code !== 0) throw new PublisherError("GIT", `pack-objects failed: ${stderr.trim().split("\n").pop() ?? ""}`);
+    if (ended.error) {
+      throw startFailure("git pack-objects", ended.error, repoDir);
+    }
+    if (opts.signal?.aborted) {
+      throw new PublisherError("CANCELLED", "pack creation cancelled");
+    }
+    if (timedOut) {
+      throw new PublisherError("GIT", `pack-objects timed out after ${timeoutMs}ms`, { retryable: true });
+    }
+    if (code !== 0) {
+      throw new PublisherError("GIT", `pack-objects failed: ${stderr.trim().split("\n").pop() ?? ""}`);
+    }
   } catch (e) {
     failure = e;
   } finally {
@@ -3689,8 +3865,12 @@ async function packObjectsToFile(repoDir, extraArgs, stdinLines, opts) {
     out.close();
   }
   const cleanup = await reapChild(child, opts.groupObserver ? { observer: opts.groupObserver } : {});
-  if (!reapSucceeded(cleanup)) throw cleanupFailure("git pack-objects", cleanup, failure ?? void 0);
-  if (failure) throw failure;
+  if (!reapSucceeded(cleanup)) {
+    throw cleanupFailure("git pack-objects", cleanup, failure ?? void 0);
+  }
+  if (failure) {
+    throw failure;
+  }
   const { sha256, size } = await sha256File(opts.outPath);
   return { sha256, size, objectCount: packObjectCount(await readPackHeader(opts.outPath)) };
 }
@@ -3715,21 +3895,31 @@ async function readPackHeader(path) {
   }
 }
 function packObjectCount(header) {
-  if (header.length < 12 || header.toString("latin1", 0, 4) !== "PACK") throw new PublisherError("PACK_INVALID", "not a pack file");
+  if (header.length < 12 || header.toString("latin1", 0, 4) !== "PACK") {
+    throw new PublisherError("PACK_INVALID", "not a pack file");
+  }
   const version2 = header.readUInt32BE(4);
-  if (version2 !== 2 && version2 !== 3) throw new PublisherError("PACK_INVALID", `unsupported pack version ${version2}`);
+  if (version2 !== 2 && version2 !== 3) {
+    throw new PublisherError("PACK_INVALID", `unsupported pack version ${version2}`);
+  }
   return header.readUInt32BE(8);
 }
 
 // ../git-core/src/bundle.ts
 async function bundleUnbundleObjects(repoDir, bundlePath, opts = {}) {
   const r = await runGit(["bundle", "unbundle", bundlePath], { cwd: repoDir, allowFailure: true, ...opts });
-  if (r.code !== 0) throw new PublisherError("PACK_INVALID", `bundle unbundle failed: ${sanitizeGitMessage(r.stderr.trim().split("\n").pop() ?? "")}`);
+  if (r.code !== 0) {
+    throw new PublisherError("PACK_INVALID", `bundle unbundle failed: ${sanitizeGitMessage(r.stderr.trim().split("\n").pop() ?? "")}`);
+  }
   const refs = {};
   for (const line of r.stdout.toString("utf8").split("\n")) {
-    if (!line) continue;
+    if (!line) {
+      continue;
+    }
     const [oid, name] = line.split(" ");
-    if (name && name !== "HEAD") refs[name] = oid;
+    if (name && name !== "HEAD") {
+      refs[name] = oid;
+    }
   }
   return refs;
 }
@@ -3750,12 +3940,19 @@ async function getConfig(dir, key) {
 async function getConfigSection(dir, section) {
   const r = await runGit(["config", "--local", "-z", "--get-regexp", `^${section.replace(/\./g, "\\.")}\\.`], { cwd: dir, allowFailure: true });
   const out = /* @__PURE__ */ new Map();
-  if (r.code !== 0) return out;
+  if (r.code !== 0) {
+    return out;
+  }
   for (const record2 of r.stdout.toString("utf8").split("\0")) {
-    if (!record2) continue;
+    if (!record2) {
+      continue;
+    }
     const nl = record2.indexOf("\n");
-    if (nl < 0) out.set(record2, "");
-    else out.set(record2.slice(0, nl), record2.slice(nl + 1).trim());
+    if (nl < 0) {
+      out.set(record2, "");
+    } else {
+      out.set(record2.slice(0, nl), record2.slice(nl + 1).trim());
+    }
   }
   return out;
 }
@@ -3766,14 +3963,19 @@ async function remoteUrl(dir, name) {
   return getConfig(dir, `remote.${name}.url`);
 }
 async function ensureRemote(dir, name, url2) {
-  if (await remoteUrl(dir, name) !== null) return "exists";
+  if (await remoteUrl(dir, name) !== null) {
+    return "exists";
+  }
   await runGit(["remote", "add", name, url2], { cwd: dir });
   await runGit(["config", "--local", `remote.${name}.pushurl`, "no_push://publisher-uses-the-publish-command"], { cwd: dir });
   return "added";
 }
 async function updateTrackingRef(dir, ref, oid) {
-  if (oid === null) await runGit(["update-ref", "-d", ref], { cwd: dir, allowFailure: true });
-  else await runGit(["update-ref", ref, oid], { cwd: dir });
+  if (oid === null) {
+    await runGit(["update-ref", "-d", ref], { cwd: dir, allowFailure: true });
+  } else {
+    await runGit(["update-ref", ref, oid], { cwd: dir });
+  }
 }
 async function currentBranch(dir) {
   const r = await runGit(["symbolic-ref", "-q", "HEAD"], { cwd: dir, allowFailure: true });
@@ -3787,7 +3989,9 @@ async function localRefs(dir, prefix = "refs/") {
   const r = await runGit(["for-each-ref", "--format=%(objectname) %(refname)", prefix], { cwd: dir });
   const out = {};
   for (const line of r.stdout.toString("utf8").split("\n")) {
-    if (!line) continue;
+    if (!line) {
+      continue;
+    }
     const sp = line.indexOf(" ");
     out[line.slice(sp + 1)] = line.slice(0, sp);
   }
@@ -3803,11 +4007,15 @@ async function statusPorcelain(dir) {
   const parts = r.stdout.toString("utf8").split("\0");
   for (let i = 0; i < parts.length; i++) {
     const p = parts[i];
-    if (!p) continue;
+    if (!p) {
+      continue;
+    }
     const code = p.slice(0, 2);
     const path = p.slice(3);
     out.push({ code, path });
-    if (code[0] === "R" || code[0] === "C") i++;
+    if (code[0] === "R" || code[0] === "C") {
+      i++;
+    }
   }
   return out;
 }
@@ -3815,13 +4023,19 @@ async function initWorkRepo(dir, branch = "main") {
   await runGit(["init", "-q", `--initial-branch=${branch}`, dir]);
 }
 async function commitPaths(dir, paths, opts) {
-  if (paths.length === 0) throw new PublisherError("LOCAL_STATE", "no files selected to commit");
+  if (paths.length === 0) {
+    throw new PublisherError("LOCAL_STATE", "no files selected to commit");
+  }
   const run = { cwd: dir, env: authorEnv(opts) };
-  if (opts.signal) run.signal = opts.signal;
+  if (opts.signal) {
+    run.signal = opts.signal;
+  }
   await runGit(["add", "--pathspec-from-file=-", "--pathspec-file-nul"], { ...run, input: paths.join("\0") + "\0" });
   await runGit(["commit", "-q", "--no-verify", "-m", opts.message], run);
   const head = await headCommit(dir);
-  if (!head) throw new PublisherError("GIT", "commit did not produce HEAD");
+  if (!head) {
+    throw new PublisherError("GIT", "commit did not produce HEAD");
+  }
   return head;
 }
 async function mergeCheck(dir, ours, theirs) {
@@ -3829,25 +4043,37 @@ async function mergeCheck(dir, ours, theirs) {
   const mergeBase = base.code === 0 ? base.stdout.toString("utf8").trim() : null;
   const oursOid = (await runGit(["rev-parse", "--verify", `${ours}^{commit}`], { cwd: dir })).stdout.toString("utf8").trim();
   const theirsOid = (await runGit(["rev-parse", "--verify", `${theirs}^{commit}`], { cwd: dir })).stdout.toString("utf8").trim();
-  if (mergeBase === theirsOid) return { ok: true, tree: null, conflicts: [], mergeBase, fastForward: "ours" };
-  if (mergeBase === oursOid) return { ok: true, tree: null, conflicts: [], mergeBase, fastForward: "theirs" };
+  if (mergeBase === theirsOid) {
+    return { ok: true, tree: null, conflicts: [], mergeBase, fastForward: "ours" };
+  }
+  if (mergeBase === oursOid) {
+    return { ok: true, tree: null, conflicts: [], mergeBase, fastForward: "theirs" };
+  }
   const r = await runGit(["merge-tree", "--write-tree", "-z", "--name-only", "--no-messages", ours, theirs], { cwd: dir, allowFailure: true });
-  if (r.code !== 0 && r.code !== 1) throw new PublisherError("GIT", `merge-tree failed: ${sanitizeGitMessage(r.stderr.trim())}`);
+  if (r.code !== 0 && r.code !== 1) {
+    throw new PublisherError("GIT", `merge-tree failed: ${sanitizeGitMessage(r.stderr.trim())}`);
+  }
   const out = r.stdout.toString("utf8");
   const parts = out.split("\0");
   const tree = parts[0] ?? null;
-  if (r.code === 0) return { ok: true, tree, conflicts: [], mergeBase, fastForward: null };
+  if (r.code === 0) {
+    return { ok: true, tree, conflicts: [], mergeBase, fastForward: null };
+  }
   const conflicts = [];
   for (let i = 1; i < parts.length; i++) {
     const p = parts[i];
-    if (p === "") break;
+    if (p === "") {
+      break;
+    }
     conflicts.push({ path: p, kind: "content" });
   }
   return { ok: false, tree, conflicts, mergeBase, fastForward: null };
 }
 async function commitTree(dir, tree, parents, message, opts = {}) {
   const args = ["commit-tree", tree, "-m", message];
-  for (const p of parents) args.push("-p", p);
+  for (const p of parents) {
+    args.push("-p", p);
+  }
   const r = await runGit(args, { cwd: dir, env: authorEnv(opts) });
   return r.stdout.toString("utf8").trim();
 }
@@ -3864,7 +4090,9 @@ async function readAssociation(repoDir) {
 function associationFrom(section) {
   const endpoint = section.get("publisher.endpoint");
   const repoId = section.get("publisher.repoid");
-  if (!endpoint || !repoId) return null;
+  if (!endpoint || !repoId) {
+    return null;
+  }
   return { endpoint, repoId, remote: section.get("publisher.remote") ?? "publisher" };
 }
 async function writeAssociation(repoDir, a) {
@@ -3883,8 +4111,12 @@ async function mergeRemote(opts) {
   const { repoDir, ours, theirs } = opts;
   const oursOid = await revParse(repoDir, ours);
   const theirsOid = await revParse(repoDir, theirs);
-  if (!oursOid) throw new PublisherError("LOCAL_STATE", `unknown local ref ${ours}`);
-  if (!theirsOid) throw new PublisherError("LOCAL_STATE", `unknown ref ${theirs}; fetch first`);
+  if (!oursOid) {
+    throw new PublisherError("LOCAL_STATE", `unknown local ref ${ours}`);
+  }
+  if (!theirsOid) {
+    throw new PublisherError("LOCAL_STATE", `unknown ref ${theirs}; fetch first`);
+  }
   const check = await mergeCheck(repoDir, oursOid, theirsOid);
   const base = { ok: check.ok, applied: false, fastForward: check.fastForward, mergeBase: check.mergeBase, mergeCommit: null, conflicts: check.conflicts, hint: "" };
   if (!check.ok) {
@@ -3893,16 +4125,21 @@ async function mergeRemote(opts) {
       hint: `conflicts in ${check.conflicts.map((c) => c.path).join(", ")}; resolve them with git merge ${theirs} in a working copy, or keep both versions and publish later`
     };
   }
-  if (check.fastForward === "ours") return { ...base, hint: "local branch already contains the fetched history" };
-  if (!opts.apply)
+  if (check.fastForward === "ours") {
+    return { ...base, hint: "local branch already contains the fetched history" };
+  }
+  if (!opts.apply) {
     return {
       ...base,
       hint: check.fastForward === "theirs" ? "fast-forward possible; run with apply to update the branch" : "clean merge possible; run with apply to create the merge commit"
     };
+  }
   const checkedOut = await currentBranch(repoDir);
   if (checkedOut === ours) {
     const dirty = (await statusPorcelain(repoDir)).filter((s) => s.code !== "??");
-    if (dirty.length > 0) throw new PublisherError("LOCAL_STATE", "the working tree has uncommitted changes; commit or stash them before applying the merge");
+    if (dirty.length > 0) {
+      throw new PublisherError("LOCAL_STATE", "the working tree has uncommitted changes; commit or stash them before applying the merge");
+    }
     if (check.fastForward === "theirs") {
       await runGit(["merge", "--ff-only", "--quiet", theirsOid], { cwd: repoDir });
       return { ...base, applied: true, mergeCommit: theirsOid, hint: "fast-forwarded" };
@@ -3946,10 +4183,14 @@ async function openPending(repoDir) {
     list: async () => {
       const out = [];
       for (const f of await (0, import_promises3.readdir)(dir)) {
-        if (!f.endsWith(".json")) continue;
+        if (!f.endsWith(".json")) {
+          continue;
+        }
         try {
           const p = JSON.parse(await (0, import_promises3.readFile)((0, import_node_path2.join)(dir, f), "utf8"));
-          if (p.version === 1) out.push(p);
+          if (p.version === 1) {
+            out.push(p);
+          }
         } catch {
         }
       }
@@ -3977,16 +4218,22 @@ var PARTIAL_MARKER = ".gitpub-checkout.json";
 async function getWorkspaceMapping(directory) {
   const dir = (0, import_node_path3.resolve)(directory);
   const section = await getConfigSection(dir, "publisher").catch(() => null);
-  if (!section) return null;
+  if (!section) {
+    return null;
+  }
   const a = associationFrom(section);
-  if (!a) return null;
+  if (!a) {
+    return null;
+  }
   const get = (k) => section.get(`${NS}.${k}`) ?? null;
   const branch = get("branch");
   const baseOid = get("baseoid");
   const baseGeneration = get("basegeneration");
   const checkedOutAt = get("checkedoutat");
   const baseAdvancedAt = get("baseadvancedat");
-  if (!branch || baseGeneration === null || !checkedOutAt) return null;
+  if (!branch || baseGeneration === null || !checkedOutAt) {
+    return null;
+  }
   return {
     directory: dir,
     endpoint: a.endpoint,
@@ -4009,9 +4256,15 @@ async function writeMapping(dir, m) {
 }
 async function advanceWorkspaceBase(directory, next, now = /* @__PURE__ */ new Date()) {
   const m = await getWorkspaceMapping(directory);
-  if (!m) throw new PublisherError("LOCAL_STATE", "not a workspace (no publisher.workspace mapping)");
-  if (next.generation < m.baseGeneration) return m;
-  if (next.generation === m.baseGeneration && next.oid === m.baseOid) return m;
+  if (!m) {
+    throw new PublisherError("LOCAL_STATE", "not a workspace (no publisher.workspace mapping)");
+  }
+  if (next.generation < m.baseGeneration) {
+    return m;
+  }
+  if (next.generation === m.baseGeneration && next.oid === m.baseOid) {
+    return m;
+  }
   const updated = { ...m, baseOid: next.oid, baseGeneration: next.generation, baseAdvancedAt: now.toISOString() };
   await setConfig(m.directory, `${NS}.baseoid`, updated.baseOid ?? "");
   await setConfig(m.directory, `${NS}.basegeneration`, String(updated.baseGeneration));
@@ -4019,29 +4272,43 @@ async function advanceWorkspaceBase(directory, next, now = /* @__PURE__ */ new D
   return updated;
 }
 async function noteAcceptedPublication(directory, outcome, now = /* @__PURE__ */ new Date()) {
-  if (outcome.state !== "accepted" || outcome.resultGeneration === null) return;
+  if (outcome.state !== "accepted" || outcome.resultGeneration === null) {
+    return;
+  }
   const m = await getWorkspaceMapping(directory).catch(() => null);
-  if (!m || m.repoId !== outcome.repoId) return;
+  if (!m || m.repoId !== outcome.repoId) {
+    return;
+  }
   const oid = outcome.refs?.[`refs/heads/${m.branch}`];
-  if (!oid) return;
+  if (!oid) {
+    return;
+  }
   await advanceWorkspaceBase(directory, { oid, generation: outcome.resultGeneration }, now);
 }
 async function adoptWorkspace(client, directory, call2 = {}, now = /* @__PURE__ */ new Date()) {
   const dir = (0, import_node_path3.resolve)(directory);
   const existing = await getWorkspaceMapping(dir);
-  if (existing) return existing;
+  if (existing) {
+    return existing;
+  }
   const section = await getConfigSection(dir, "publisher").catch(() => null);
   const a = section ? associationFrom(section) : null;
-  if (!a) throw new PublisherError("LOCAL_STATE", "this folder is not associated with a published repository; run init first");
+  if (!a) {
+    throw new PublisherError("LOCAL_STATE", "this folder is not associated with a published repository; run init first");
+  }
   const branch = (await currentBranch(dir))?.replace(/^refs\/heads\//, "") ?? null;
-  if (!branch) throw new PublisherError("LOCAL_STATE", "HEAD is detached; check out the branch this folder publishes, then run sync again");
+  if (!branch) {
+    throw new PublisherError("LOCAL_STATE", "HEAD is detached; check out the branch this folder publishes, then run sync again");
+  }
   const repo = await client.getRepository(a.repoId, call2);
   const remoteOid = repo.refs[`refs/heads/${branch}`] ?? null;
   const tip = await revParse(dir, `refs/heads/${branch}`);
   let baseOid = null;
   let baseGeneration = 0;
   if (remoteOid) {
-    if (!await objectExists(dir, remoteOid)) await client.fetch({ repoDir: dir, repoId: a.repoId, remote: a.remote }, call2);
+    if (!await objectExists(dir, remoteOid)) {
+      await client.fetch({ repoDir: dir, repoId: a.repoId, remote: a.remote }, call2);
+    }
     const haveRemote = await objectExists(dir, remoteOid);
     if (!tip) {
       baseOid = haveRemote ? remoteOid : null;
@@ -4071,8 +4338,12 @@ async function isEmptyDir(p) {
   try {
     return (await (0, import_promises4.readdir)(p)).length === 0;
   } catch (e) {
-    if (e.code === "ENOENT") return null;
-    if (e.code === "ENOTDIR") return false;
+    if (e.code === "ENOENT") {
+      return null;
+    }
+    if (e.code === "ENOTDIR") {
+      return false;
+    }
     throw e;
   }
 }
@@ -4087,11 +4358,15 @@ async function removeStalePartials(target, repoId) {
     return removed;
   }
   for (const name of entries) {
-    if (!name.startsWith(prefix)) continue;
+    if (!name.startsWith(prefix)) {
+      continue;
+    }
     const p = (0, import_node_path3.join)(parent, name);
     try {
       const marker = JSON.parse(await (0, import_promises4.readFile)((0, import_node_path3.join)(p, PARTIAL_MARKER), "utf8"));
-      if (marker.target !== target || marker.repoId !== repoId) continue;
+      if (marker.target !== target || marker.repoId !== repoId) {
+        continue;
+      }
     } catch {
       continue;
     }
@@ -4104,14 +4379,20 @@ async function checkoutWorkspace(client, opts, call2 = {}, now = /* @__PURE__ */
   const target = (0, import_node_path3.resolve)(opts.directory);
   const remote = opts.remote ?? "publisher";
   const empty2 = await isEmptyDir(target);
-  if (empty2 === false) throw new PublisherError("LOCAL_STATE", `${target} exists and is not empty; checkout never overlays an existing folder`);
+  if (empty2 === false) {
+    throw new PublisherError("LOCAL_STATE", `${target} exists and is not empty; checkout never overlays an existing folder`);
+  }
   await (0, import_promises4.mkdir)((0, import_node_path3.dirname)(target), { recursive: true });
   const removed = await removeStalePartials(target, opts.repoId);
-  if (removed.length) call2.onProgress?.({ phase: "checkout", message: `removed ${removed.length} interrupted checkout(s)` });
+  if (removed.length) {
+    call2.onProgress?.({ phase: "checkout", message: `removed ${removed.length} interrupted checkout(s)` });
+  }
   const repo = await client.getRepository(opts.repoId, call2);
   const branch = opts.branch ?? repo.head.symbolic.replace(/^refs\/heads\//, "");
   const tip = repo.refs[`refs/heads/${branch}`] ?? null;
-  if (!tip && Object.keys(repo.refs).length > 0) throw new PublisherError("LOCAL_STATE", `branch ${branch} does not exist on the server`);
+  if (!tip && Object.keys(repo.refs).length > 0) {
+    throw new PublisherError("LOCAL_STATE", `branch ${branch} does not exist on the server`);
+  }
   const partial2 = (0, import_node_path3.join)((0, import_node_path3.dirname)(target), `.${(0, import_node_path3.basename)(target)}.partial-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}`);
   await (0, import_promises4.mkdir)(partial2);
   try {
@@ -4122,7 +4403,9 @@ async function checkoutWorkspace(client, opts, call2 = {}, now = /* @__PURE__ */
       await client.fetch({ repoDir: partial2, repoId: opts.repoId, remote }, call2);
       const tracking = `refs/remotes/${remote}/${branch}`;
       const have = await revParse(partial2, tracking);
-      if (have !== tip) throw new PublisherError("LOCAL_STATE", `fetched ${tracking} is ${have ?? "missing"}, expected ${tip}; retry the checkout`);
+      if (have !== tip) {
+        throw new PublisherError("LOCAL_STATE", `fetched ${tracking} is ${have ?? "missing"}, expected ${tip}; retry the checkout`);
+      }
       await runGit(["branch", "-q", "--no-track", branch, tip], { cwd: partial2 });
       await runGit(["checkout", "-q", branch], { cwd: partial2 });
       await runGit(["branch", `--set-upstream-to=${tracking}`, branch], { cwd: partial2, allowFailure: true });
@@ -4138,7 +4421,9 @@ async function checkoutWorkspace(client, opts, call2 = {}, now = /* @__PURE__ */
       baseAdvancedAt: now.toISOString()
     });
     await (0, import_promises4.rm)((0, import_node_path3.join)(partial2, PARTIAL_MARKER), { force: true });
-    if (empty2 === true) await (0, import_promises4.rm)(target, { recursive: false, force: true }).catch(() => void 0);
+    if (empty2 === true) {
+      await (0, import_promises4.rm)(target, { recursive: false, force: true }).catch(() => void 0);
+    }
     await (0, import_promises4.rename)(partial2, target);
   } catch (e) {
     await (0, import_promises4.rm)(partial2, { recursive: true, force: true }).catch(() => void 0);
@@ -4161,7 +4446,7 @@ async function inspectWorkspace(client, directory, call2 = {}) {
   const dir = (0, import_node_path3.resolve)(directory);
   const mapping = await getWorkspaceMapping(dir);
   const pending = await listPending(dir).catch(() => []);
-  if (!mapping)
+  if (!mapping) {
     return {
       state: "unassociated",
       mapping: null,
@@ -4171,6 +4456,7 @@ async function inspectWorkspace(client, directory, call2 = {}) {
       conflicts: [],
       hint: "not a workspace yet; run sync here (an associated folder adopts itself), or checkout to create one"
     };
+  }
   const branchRef = `refs/heads/${mapping.branch}`;
   const tip = await revParse(dir, branchRef);
   const head = await revParse(dir, "HEAD");
@@ -4183,7 +4469,9 @@ async function inspectWorkspace(client, directory, call2 = {}) {
   const repo = await client.getRepository(mapping.repoId, call2);
   const remoteOid = repo.refs[branchRef] ?? null;
   const remote = { oid: remoteOid, generation: repo.generation };
-  if (mapping.baseOid && tip) local.commitsAheadOfBase = await countCommits(dir, `${mapping.baseOid}..${tip}`);
+  if (mapping.baseOid && tip) {
+    local.commitsAheadOfBase = await countCommits(dir, `${mapping.baseOid}..${tip}`);
+  }
   const done = (state, hint, conflicts = []) => ({ state, mapping, local, remote, pending, conflicts, hint });
   const work = dirty && untrackedPaths.length > 0 ? "uncommitted and untracked files" : dirty ? "uncommitted changes" : `${untrackedPaths.length} untracked file(s)`;
   if (checkedOut !== mapping.branch && !(checkedOut === null && head === null && tip === null)) {
@@ -4193,32 +4481,42 @@ async function inspectWorkspace(client, directory, call2 = {}) {
     );
   }
   if (!remoteOid) {
-    if (!tip) return done(hasLocalWork ? "local_changes" : "up_to_date", hasLocalWork ? `${work}; publisher sync records and publishes them` : "empty on both sides");
+    if (!tip) {
+      return done(hasLocalWork ? "local_changes" : "up_to_date", hasLocalWork ? `${work}; publisher sync records and publishes them` : "empty on both sides");
+    }
     return done("local_changes", "the server has no such branch yet; publisher sync creates it");
   }
-  if (!tip) return done("remote_ahead", hasLocalWork ? `local branch is unborn and there are ${work}; move them aside, then sync` : "local branch is unborn; sync to fast-forward");
+  if (!tip) {
+    return done("remote_ahead", hasLocalWork ? `local branch is unborn and there are ${work}; move them aside, then sync` : "local branch is unborn; sync to fast-forward");
+  }
   if (!await objectExists(dir, remoteOid)) {
     await client.fetch({ repoDir: dir, repoId: mapping.repoId, remote: mapping.remote }, call2);
-    if (!await objectExists(dir, remoteOid)) return done("remote_ahead", "server tip could not be fetched; retry");
+    if (!await objectExists(dir, remoteOid)) {
+      return done("remote_ahead", "server tip could not be fetched; retry");
+    }
   }
-  if (remoteOid === tip)
+  if (remoteOid === tip) {
     return done(hasLocalWork ? "local_changes" : "up_to_date", hasLocalWork ? `${work}; publisher sync records and publishes them` : "in sync with the server");
-  if (await isAncestor(dir, remoteOid, tip))
+  }
+  if (await isAncestor(dir, remoteOid, tip)) {
     return done(
       "local_changes",
       hasLocalWork ? `local commits and ${work}; publisher sync records and publishes them` : "local commits not yet published; publisher sync publishes them"
     );
-  if (await isAncestor(dir, tip, remoteOid))
+  }
+  if (await isAncestor(dir, tip, remoteOid)) {
     return done(
       "remote_ahead",
       hasLocalWork ? `server moved ahead and there are ${work}; publisher sync records them, brings the server's changes in and publishes` : "server moved ahead; publisher sync brings it in"
     );
+  }
   const merge2 = await mergeRemote({ repoDir: dir, ours: branchRef, theirs: remoteOid, apply: false });
-  if (merge2.ok)
+  if (merge2.ok) {
     return done(
       "diverged_clean_merge",
       hasLocalWork ? `both sides changed, merge is clean; publisher sync records the ${work}, merges and publishes` : "both sides changed, merge is clean; publisher sync merges and publishes"
     );
+  }
   return done(
     "conflict",
     `both sides changed ${merge2.conflicts.map((c) => c.path).join(", ")}; resolve with git merge ${remoteOid} in the workspace, then publish`,
@@ -4229,19 +4527,27 @@ async function syncWorkspace(client, opts, call2 = {}, now = /* @__PURE__ */ new
   const dir = (0, import_node_path3.resolve)(opts.directory);
   await adoptWorkspace(client, dir, call2, now);
   const before = await inspectWorkspace(client, dir, call2);
-  if (!before.mapping) throw new PublisherError("LOCAL_STATE", "not a workspace; run checkout");
+  if (!before.mapping) {
+    throw new PublisherError("LOCAL_STATE", "not a workspace; run checkout");
+  }
   const mapping = before.mapping;
   const branchRef = `refs/heads/${mapping.branch}`;
   let applied = null;
-  if (before.state === "detached") throw new PublisherError("LOCAL_STATE", before.hint);
+  if (before.state === "detached") {
+    throw new PublisherError("LOCAL_STATE", before.hint);
+  }
   if (opts.apply && before.remote?.oid && (before.state === "remote_ahead" || before.state === "diverged_clean_merge")) {
-    if (before.local?.dirty) throw new PublisherError("LOCAL_STATE", "the working tree has uncommitted changes; record them first (publisher sync does)");
+    if (before.local?.dirty) {
+      throw new PublisherError("LOCAL_STATE", "the working tree has uncommitted changes; record them first (publisher sync does)");
+    }
     if (!before.local?.tip) {
       await runGit(["checkout", "-q", "-B", mapping.branch, before.remote.oid], { cwd: dir });
       applied = "fast-forward";
     } else {
       const r = await mergeRemote({ repoDir: dir, ours: branchRef, theirs: before.remote.oid, apply: true, ...opts.message ? { message: opts.message } : {} });
-      if (!r.applied) throw new PublisherError("LOCAL_STATE", r.hint);
+      if (!r.applied) {
+        throw new PublisherError("LOCAL_STATE", r.hint);
+      }
       applied = r.fastForward === "theirs" ? "fast-forward" : "merge";
     }
   }
@@ -4262,19 +4568,30 @@ var import_node_os2 = require("node:os");
 var import_node_path4 = require("node:path");
 
 // ../client/src/form-post.ts
+var FORM_POST_TIMEOUT_MS = 1e4;
 async function postForm(base, path, fields, fetchImpl = globalThis.fetch) {
-  let res;
+  const bound = new AbortController();
+  const timer = setTimeout(() => bound.abort(new DOMException("the request timed out", "TimeoutError")), FORM_POST_TIMEOUT_MS);
   try {
-    res = await fetchImpl(`${base}${path}`, {
-      method: "POST",
-      headers: { "content-type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams(fields).toString()
-    });
-  } catch (e) {
-    throw new PublisherError("UNAVAILABLE", `could not reach ${base}: ${e instanceof Error ? e.message : String(e)}`, { retryable: true, cause: e });
+    let res;
+    try {
+      res = await fetchImpl(`${base}${path}`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams(fields).toString(),
+        signal: bound.signal
+      });
+    } catch (e) {
+      throw new PublisherError("UNAVAILABLE", `could not reach ${base}: ${e instanceof Error ? e.message : String(e)}`, { retryable: true, cause: e });
+    }
+    const body = await res.json().catch(() => ({}));
+    if (bound.signal.aborted) {
+      throw new PublisherError("UNAVAILABLE", `could not reach ${base}: the request timed out`, { retryable: true });
+    }
+    return { status: res.status, body: typeof body === "object" && body !== null ? body : {} };
+  } finally {
+    clearTimeout(timer);
   }
-  const body = await res.json().catch(() => ({}));
-  return { status: res.status, body: typeof body === "object" && body !== null ? body : {} };
 }
 
 // ../client/src/credentials.ts
@@ -4284,7 +4601,9 @@ function credentialsPath() {
 }
 function credentialsLocation() {
   const explicit = process.env["GIT_PUBLISHER_CREDENTIALS"];
-  if (explicit) return { path: explicit, from: "GIT_PUBLISHER_CREDENTIALS" };
+  if (explicit) {
+    return { path: explicit, from: "GIT_PUBLISHER_CREDENTIALS" };
+  }
   const xdg = process.env["XDG_CONFIG_HOME"];
   return { path: (0, import_node_path4.join)(xdg ?? (0, import_node_path4.join)((0, import_node_os2.homedir)(), ".config"), "git-publisher", "credentials.json"), from: xdg ? "XDG_CONFIG_HOME" : "HOME" };
 }
@@ -4331,28 +4650,46 @@ function hasReadableName(endpoint) {
   } catch {
     return false;
   }
-  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host) || host.includes(":")) return false;
-  if (/\.lambda-url\.[a-z0-9-]+\.on\.aws$/.test(host)) return false;
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host) || host.includes(":")) {
+    return false;
+  }
+  if (/\.lambda-url\.[a-z0-9-]+\.on\.aws$/.test(host)) {
+    return false;
+  }
   return Boolean(slug(host.split(".")[0] ?? ""));
 }
 function profileNameFor(endpoint, taken) {
   const host = hasReadableName(endpoint) ? new URL(endpoint).hostname : "";
   const candidates = host ? [slug(host.split(".")[0] ?? ""), slug(host)] : ["default"];
-  for (const c of candidates) if (c && !taken.has(c)) return c;
+  for (const c of candidates) {
+    if (c && !taken.has(c)) {
+      return c;
+    }
+  }
   const base = candidates.filter(Boolean).pop() ?? "default";
-  for (let n = 2; ; n++) if (!taken.has(`${base}-${n}`)) return `${base}-${n}`;
+  for (let n = 2; ; n++) {
+    if (!taken.has(`${base}-${n}`)) {
+      return `${base}-${n}`;
+    }
+  }
 }
 var empty = () => ({ version: 1, endpoints: {}, profiles: {} });
 function parse2(raw) {
-  if (!raw || typeof raw !== "object") return empty();
+  if (!raw || typeof raw !== "object") {
+    return empty();
+  }
   const r = raw;
-  if (r.version !== 1) return empty();
+  if (r.version !== 1) {
+    return empty();
+  }
   const out = {
     version: 1,
     endpoints: r.endpoints && typeof r.endpoints === "object" ? r.endpoints : {},
     profiles: r.profiles && typeof r.profiles === "object" ? r.profiles : {}
   };
-  if (typeof r.defaultProfile === "string") out.defaultProfile = r.defaultProfile;
+  if (typeof r.defaultProfile === "string") {
+    out.defaultProfile = r.defaultProfile;
+  }
   return out;
 }
 async function readCredentials() {
@@ -4380,7 +4717,9 @@ async function writeSecretJson(path, value) {
   return path;
 }
 function pruneDefault(file) {
-  if (file.defaultProfile && !file.profiles[file.defaultProfile]) delete file.defaultProfile;
+  if (file.defaultProfile && !file.profiles[file.defaultProfile]) {
+    delete file.defaultProfile;
+  }
   return file;
 }
 async function saveCredential(endpoint, token, principal, opts = {}) {
@@ -4403,7 +4742,9 @@ async function store(url2, entry, opts) {
   const existing = Object.entries(file.profiles).find(([, p]) => normalize(p.endpoint) === url2)?.[0];
   const name = opts.profile ?? existing ?? profileNameFor(url2, new Set(Object.keys(file.profiles)));
   file.profiles[name] = { endpoint: url2 };
-  if (opts.setDefault || !file.defaultProfile) file.defaultProfile = name;
+  if (opts.setDefault || !file.defaultProfile) {
+    file.defaultProfile = name;
+  }
   return writeCredentials(pruneDefault(file));
 }
 async function removeCredential(endpoint, opts = {}) {
@@ -4411,14 +4752,20 @@ async function removeCredential(endpoint, opts = {}) {
   const url2 = normalize(endpoint);
   const revoked = await revokeEntry(file.endpoints[url2], opts);
   delete file.endpoints[url2];
-  for (const [name, p] of Object.entries(file.profiles)) if (normalize(p.endpoint) === url2) delete file.profiles[name];
+  for (const [name, p] of Object.entries(file.profiles)) {
+    if (normalize(p.endpoint) === url2) {
+      delete file.profiles[name];
+    }
+  }
   await writeCredentials(pruneDefault(file));
   return { revoked };
 }
 async function removeProfile(name, opts = {}) {
   const file = await readCredentials();
   const entry = file.profiles[name];
-  if (!entry) throw new PublisherError("LOCAL_STATE", `no such profile: ${name}`, { details: { profiles: Object.keys(file.profiles) } });
+  if (!entry) {
+    throw new PublisherError("LOCAL_STATE", `no such profile: ${name}`, { details: { profiles: Object.keys(file.profiles) } });
+  }
   delete file.profiles[name];
   const url2 = normalize(entry.endpoint);
   let revoked = false;
@@ -4430,7 +4777,9 @@ async function removeProfile(name, opts = {}) {
   return { revoked };
 }
 async function revokeEntry(entry, opts) {
-  if (!opts.revoke || !entry?.refreshToken || !entry.authEndpoint) return false;
+  if (!opts.revoke || !entry?.refreshToken || !entry.authEndpoint) {
+    return false;
+  }
   try {
     return (await postForm(entry.authEndpoint, "/v1/auth/revoke", { token: entry.refreshToken }, opts.fetch)).status === 200;
   } catch {
@@ -4439,7 +4788,9 @@ async function revokeEntry(entry, opts) {
 }
 async function setDefaultProfile(name) {
   const file = await readCredentials();
-  if (!file.profiles[name]) throw new PublisherError("LOCAL_STATE", `no such profile: ${name}`, { details: { profiles: Object.keys(file.profiles) } });
+  if (!file.profiles[name]) {
+    throw new PublisherError("LOCAL_STATE", `no such profile: ${name}`, { details: { profiles: Object.keys(file.profiles) } });
+  }
   file.defaultProfile = name;
   await writeCredentials(file);
 }
@@ -4452,14 +4803,30 @@ function resolveEndpoint(input) {
     const p = input.file.profiles[name];
     return p ? { kind: "resolved", endpoint: normalize(p.endpoint), source, profile: name } : { kind: "unknown-profile", name, profiles: names };
   };
-  if (input.endpoint) return { kind: "resolved", endpoint: normalize(input.endpoint), source: "flag" };
-  if (input.profile) return byName(input.profile, "profile-flag");
-  if (input.env["GIT_PUBLISHER_ENDPOINT"]) return { kind: "resolved", endpoint: normalize(input.env["GIT_PUBLISHER_ENDPOINT"]), source: "env-endpoint" };
-  if (input.env["GIT_PUBLISHER_PROFILE"]) return byName(input.env["GIT_PUBLISHER_PROFILE"], "env-profile");
-  if (input.association) return { kind: "resolved", endpoint: normalize(input.association), source: "association" };
-  if (input.file.defaultProfile && input.file.profiles[input.file.defaultProfile]) return byName(input.file.defaultProfile, "default-profile");
-  if (names.length === 1) return byName(names[0], "sole-profile");
-  if (names.length > 1) return { kind: "ambiguous", profiles: names };
+  if (input.endpoint) {
+    return { kind: "resolved", endpoint: normalize(input.endpoint), source: "flag" };
+  }
+  if (input.profile) {
+    return byName(input.profile, "profile-flag");
+  }
+  if (input.env["GIT_PUBLISHER_ENDPOINT"]) {
+    return { kind: "resolved", endpoint: normalize(input.env["GIT_PUBLISHER_ENDPOINT"]), source: "env-endpoint" };
+  }
+  if (input.env["GIT_PUBLISHER_PROFILE"]) {
+    return byName(input.env["GIT_PUBLISHER_PROFILE"], "env-profile");
+  }
+  if (input.association) {
+    return { kind: "resolved", endpoint: normalize(input.association), source: "association" };
+  }
+  if (input.file.defaultProfile && input.file.profiles[input.file.defaultProfile]) {
+    return byName(input.file.defaultProfile, "default-profile");
+  }
+  if (names.length === 1) {
+    return byName(names[0], "sole-profile");
+  }
+  if (names.length > 1) {
+    return { kind: "ambiguous", profiles: names };
+  }
   return { kind: "none" };
 }
 function credentialStatus(input) {
@@ -4476,16 +4843,21 @@ function credentialStatus(input) {
 function nextStep(status) {
   const profiles = status.profiles.map((p) => p.name);
   const r = status.resolution;
-  if (status.credentials === "ok") return { action: "ready", ask: null, command: null, profiles };
-  if (status.credentials === "unbound") return { action: "bind-endpoint", ask: null, command: null, profiles };
-  if (r.kind === "ambiguous" || r.kind === "unknown-profile")
+  if (status.credentials === "ok") {
+    return { action: "ready", ask: null, command: null, profiles };
+  }
+  if (status.credentials === "unbound") {
+    return { action: "bind-endpoint", ask: null, command: null, profiles };
+  }
+  if (r.kind === "ambiguous" || r.kind === "unknown-profile") {
     return {
       action: "choose-profile",
       ask: "which of these places to publish to",
       command: "publisher profile use <name> --json",
       profiles
     };
-  if (r.kind === "resolved")
+  }
+  if (r.kind === "resolved") {
     return {
       action: "reauthenticate",
       // Nothing to ask: the sign-in opens a browser and asks them there.
@@ -4493,6 +4865,7 @@ function nextStep(status) {
       command: r.profile ? `publisher login --profile ${r.profile} --json` : `publisher login --endpoint ${r.endpoint} --json`,
       profiles
     };
+  }
   return { action: "sign-in", ask: null, command: "publisher login --json", profiles };
 }
 function resolveLoginEndpoint(input) {
@@ -4501,7 +4874,9 @@ function resolveLoginEndpoint(input) {
   return endpoint ? { endpoint: normalize(endpoint) } : { discover: true };
 }
 function profileForEndpoint(file, endpoint, requested) {
-  if (requested && file.profiles[requested]) return requested;
+  if (requested && file.profiles[requested]) {
+    return requested;
+  }
   const url2 = normalize(endpoint);
   return Object.keys(file.profiles).find((n) => normalize(file.profiles[n].endpoint) === url2) ?? null;
 }
@@ -4516,7 +4891,9 @@ async function resolveToken(endpoint, explicit, opts = {}) {
       { details: { endpoint: url3, endpointSource: opts.endpointSource, next: { action: "bind-endpoint", ask: null, command: null, profiles: [] } } }
     );
   }
-  if (given) return given;
+  if (given) {
+    return given;
+  }
   const url2 = normalize(endpoint);
   const entry = (await readCredentials()).endpoints[url2];
   if (!entry) {
@@ -4527,14 +4904,20 @@ async function resolveToken(endpoint, explicit, opts = {}) {
   }
   const now = (opts.now ?? Date.now)();
   const lapsed = entry.expiresAt !== void 0 && Date.parse(entry.expiresAt) - REFRESH_EARLY_MS <= now;
-  if (entry.refreshToken && entry.authEndpoint && lapsed) return refreshCredential(url2, entry, opts);
+  if (entry.refreshToken && entry.authEndpoint && lapsed) {
+    return refreshCredential(url2, entry, opts);
+  }
   return entry.token;
 }
 async function refreshStoredCredential(endpoint, opts = {}) {
-  if (process.env["GIT_PUBLISHER_TOKEN"]) return false;
+  if (process.env["GIT_PUBLISHER_TOKEN"]) {
+    return false;
+  }
   const url2 = normalize(endpoint);
   const entry = (await readCredentials()).endpoints[url2];
-  if (!entry?.refreshToken || !entry.authEndpoint) return false;
+  if (!entry?.refreshToken || !entry.authEndpoint) {
+    return false;
+  }
   await refreshCredential(url2, entry, opts);
   return true;
 }
@@ -4554,22 +4937,48 @@ async function refreshCredential(url2, entry, opts) {
     return access_token;
   }
   const rotated = res.status === 400 && res.body["error"] === "refresh_token_rotated";
-  if (!rotated && (res.status !== 400 || res.body["error"] !== "invalid_grant"))
+  if (!rotated && (res.status !== 400 || res.body["error"] !== "invalid_grant")) {
     throw new PublisherError("UNAVAILABLE", `the credentials service answered ${res.status}`, { retryable: true });
+  }
   const current = (await readCredentials()).endpoints[url2];
-  if (current?.refreshToken && current.refreshToken !== entry.refreshToken) return current.token;
-  if (rotated) throw new PublisherError("UNAVAILABLE", `another process is refreshing the sign-in for ${url2}; retry`, { retryable: true });
+  if (current?.refreshToken && current.refreshToken !== entry.refreshToken) {
+    return current.token;
+  }
+  if (rotated) {
+    throw new PublisherError("UNAVAILABLE", `another process is refreshing the sign-in for ${url2}; retry`, { retryable: true });
+  }
   await updateEntry(url2, ({ refreshToken: _dropped, ...rest }) => rest);
   throw new PublisherError("UNAUTHORIZED", `the sign-in for ${url2} has ended; run "publisher login" again`, { details: { signIn: "ended" } });
 }
 async function updateEntry(url2, change) {
   const file = await readCredentials();
   const entry = file.endpoints[url2];
-  if (!entry) return;
+  if (!entry) {
+    return;
+  }
   file.endpoints[url2] = change(entry);
   await writeCredentials(file);
 }
 
+// ../client/src/portal-refusal.ts
+function portalRefusalCode(body) {
+  if (!isRecord(body)) {
+    return null;
+  }
+  const error2 = body["error"];
+  if (typeof error2 === "string") {
+    return error2 === "" ? null : error2;
+  }
+  if (!isRecord(error2)) {
+    return null;
+  }
+  const { code, message } = error2;
+  return typeof code === "string" && code !== "" && typeof message === "string" ? code : null;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // ../client/src/application.ts
 var APPLICATION_CREATION = "application-creation";
 var ATTEMPTS = 3;
@@ -4587,26 +4996,38 @@ async function createApplication(input, opts) {
     const answer = await post(fetchImpl, url2, await opts.token(), body);
     if (answer.status === 401 && !refreshed && opts.refresh !== void 0) {
       refreshed = true;
-      if (await opts.refresh()) continue;
+      if (await opts.refresh()) {
+        continue;
+      }
     }
-    if (answer.status === 200 || answer.status === 201) return read(answer.body, answer.status === 201);
-    const code = isRecord(answer.body) && typeof answer.body["error"] === "string" ? answer.body["error"] : "";
-    if (answer.status === 401) throw new PublisherError("UNAUTHORIZED", 'the portal did not accept this credential; run "publisher login" again');
-    if (answer.status === 403) throw new PublisherError("FORBIDDEN", `the portal refused to make an application here (${code || "forbidden"})`);
-    if (answer.status === 409 && REFUSALS[code] !== void 0)
+    if (answer.status === 200 || answer.status === 201) {
+      return read(answer.body, answer.status === 201);
+    }
+    const code = portalRefusalCode(answer.body) ?? "";
+    if (answer.status === 401) {
+      throw new PublisherError("UNAUTHORIZED", 'the portal did not accept this credential; run "publisher login" again');
+    }
+    if (answer.status === 403) {
+      throw new PublisherError("FORBIDDEN", `the portal refused to make an application here (${code || "forbidden"})`);
+    }
+    if (answer.status === 409 && REFUSALS[code] !== void 0) {
       throw new PublisherError(REFUSALS[code], `the portal refused the repository (${code})`, { details: { portal: code } });
-    if (answer.status === 400 || answer.status === 409)
+    }
+    if (answer.status === 400 || answer.status === 409) {
       throw new PublisherError("INVALID_REQUEST", `the portal refused the request (${code || answer.status})`, { details: { portal: code } });
+    }
     lastOutage = answer.status === 0 ? "the portal could not be reached" : `the portal answered ${answer.status}`;
     attempt += 1;
-    if (attempt < ATTEMPTS) await new Promise((resolve3) => setTimeout(resolve3, (opts.retryDelayMs ?? 1e3) * attempt));
+    if (attempt < ATTEMPTS) {
+      await new Promise((resolve3) => setTimeout(resolve3, (opts.retryDelayMs ?? 1e3) * attempt));
+    }
   }
   throw new PublisherError("UNAVAILABLE", `could not make the application: ${lastOutage}; run init again`, { retryable: true });
 }
 function read(body, created) {
-  const application = isRecord(body) ? body["application"] : void 0;
-  const repository = RepositoryInfo.safeParse(isRecord(body) ? body["repository"] : void 0);
-  if (!isRecord(application) || typeof application["appId"] !== "string" || !repository.success) {
+  const application = isRecord2(body) ? body["application"] : void 0;
+  const repository = RepositoryInfo.safeParse(isRecord2(body) ? body["repository"] : void 0);
+  if (!isRecord2(application) || typeof application["appId"] !== "string" || !repository.success) {
     throw new PublisherError("UNAVAILABLE", "the portal answered with an application this version cannot read");
   }
   return { appId: application["appId"], created, repository: repository.data };
@@ -4629,7 +5050,7 @@ async function post(fetchImpl, url2, token, body) {
     return { status: 0, body: null };
   }
 }
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -4666,9 +5087,13 @@ var Transport = class {
       } catch (e) {
         if (e instanceof PublisherError && e.httpStatus === 401 && !refreshed && this.opts.refresh) {
           refreshed = true;
-          if (await this.opts.refresh()) continue;
+          if (await this.opts.refresh()) {
+            continue;
+          }
+        }
+        if (!(e instanceof PublisherError) || !e.retryable || attempt > retries || ro.signal?.aborted) {
+          throw e;
         }
-        if (!(e instanceof PublisherError) || !e.retryable || attempt > retries || ro.signal?.aborted) throw e;
         const delay2 = (this.opts.retryDelayMs ?? 300) * 2 ** (attempt - 1) * (0.5 + Math.random());
         await sleep(Math.min(delay2, 1e4), ro.signal);
       }
@@ -4681,7 +5106,9 @@ var Transport = class {
     const timer = setTimeout(() => controller.abort(new PublisherError("NETWORK", "request timed out", { retryable: true })), this.opts.timeoutMs ?? 6e4);
     const onAbort = () => controller.abort(new PublisherError("CANCELLED", "cancelled"));
     ro.signal?.addEventListener("abort", onAbort, { once: true });
-    if (ro.signal?.aborted) onAbort();
+    if (ro.signal?.aborted) {
+      onAbort();
+    }
     try {
       let res;
       try {
@@ -4698,7 +5125,9 @@ var Transport = class {
           signal: controller.signal
         });
       } catch (e) {
-        if (controller.signal.aborted && controller.signal.reason instanceof PublisherError) throw controller.signal.reason;
+        if (controller.signal.aborted && controller.signal.reason instanceof PublisherError) {
+          throw controller.signal.reason;
+        }
         throw new PublisherError("NETWORK", `request failed: ${e.message}`, { retryable: true, cause: e });
       }
       const text = await res.text();
@@ -4710,7 +5139,9 @@ var Transport = class {
           parsed = null;
         }
       }
-      if (res.ok) return { status: res.status, body: parsed, headers: res.headers };
+      if (res.ok) {
+        return { status: res.status, body: parsed, headers: res.headers };
+      }
       const err = parsed?.error;
       const code = err && ERROR_CODES.includes(err.code) ? err.code : fallbackCode(res.status);
       throw new PublisherError(code, err?.message ?? `HTTP ${res.status}`, {
@@ -4725,9 +5156,15 @@ var Transport = class {
   }
 };
 function fallbackCode(status) {
-  if (status === 401) return "UNAUTHORIZED";
-  if (status === 403) return "FORBIDDEN";
-  if (status === 429) return "UNAVAILABLE";
+  if (status === 401) {
+    return "UNAUTHORIZED";
+  }
+  if (status === 403) {
+    return "FORBIDDEN";
+  }
+  if (status === 429) {
+    return "UNAVAILABLE";
+  }
   return status >= 500 ? "UNAVAILABLE" : "INVALID_REQUEST";
 }
 function sleep(ms, signal) {
@@ -4749,27 +5186,47 @@ var RUN_STAGES = ["received", "running", "deploying", "live"];
 var STAGE_WORDS = { received: "received", running: "checked", deploying: "going live", live: "live" };
 var STATES = ["pending", "in-progress", "done", "failed", "skipped"];
 function readStages(run) {
-  if (!isRecord2(run)) return { malformed: "a run that is not an object" };
-  if (!Object.hasOwn(run, "stages")) return null;
+  if (!isRecord3(run)) {
+    return { malformed: "a run that is not an object" };
+  }
+  if (!Object.hasOwn(run, "stages")) {
+    return null;
+  }
   const stages = run["stages"];
-  if (!Array.isArray(stages) || stages.length !== RUN_STAGES.length) return { malformed: "stages that are not exactly four" };
+  if (!Array.isArray(stages) || stages.length !== RUN_STAGES.length) {
+    return { malformed: "stages that are not exactly four" };
+  }
   const out = [];
   for (const [index, entry] of stages.entries()) {
     const stage = RUN_STAGES[index];
-    if (!isRecord2(entry) || entry["stage"] !== stage) return { malformed: `stage ${index + 1} is not ${stage}` };
+    if (!isRecord3(entry) || entry["stage"] !== stage) {
+      return { malformed: `stage ${index + 1} is not ${stage}` };
+    }
     const state = entry["state"];
-    if (!STATES.includes(state)) return { malformed: `stage ${stage} has an unknown state` };
+    if (!STATES.includes(state)) {
+      return { malformed: `stage ${stage} has an unknown state` };
+    }
     const at = entry["at"];
-    if (typeof at !== "string" && at !== null) return { malformed: `stage ${stage} has an unreadable time` };
+    if (typeof at !== "string" && at !== null) {
+      return { malformed: `stage ${stage} has an unreadable time` };
+    }
     out.push({ stage, word: STAGE_WORDS[stage], state, at });
   }
   return { stages: out };
 }
 function ending(stages) {
-  if (stages.some((s) => s.state === "pending" || s.state === "in-progress")) return null;
-  if (stages.some((s) => s.state === "failed")) return "failed";
-  if (stages[3].state === "done") return "live";
-  if (stages[1].state === "done" && stages[2].state === "skipped") return "not-deployed";
+  if (stages.some((s) => s.state === "pending" || s.state === "in-progress")) {
+    return null;
+  }
+  if (stages.some((s) => s.state === "failed")) {
+    return "failed";
+  }
+  if (stages[3].state === "done") {
+    return "live";
+  }
+  if (stages[1].state === "done" && stages[2].state === "skipped") {
+    return "not-deployed";
+  }
   return "stopped";
 }
 var POLL_INTERVAL_MS = 5e3;
@@ -4791,47 +5248,73 @@ async function followRun(input, opts) {
     const answer = await ask(fetchImpl, url2, await opts.token());
     if (answer.status === 401 && !refreshed && opts.refresh !== void 0) {
       refreshed = true;
-      if (await opts.refresh()) continue;
+      if (await opts.refresh()) {
+        continue;
+      }
+    }
+    if (answer.status === 401) {
+      return { kind: "unauthorized" };
+    }
+    if (answer.status === 404) {
+      return { kind: "unavailable", reason: "no-route" };
+    }
+    if (answer.status === 403) {
+      return { kind: "forbidden" };
     }
-    if (answer.status === 401) return { kind: "unauthorized" };
-    if (answer.status === 404) return { kind: "unavailable", reason: "no-route" };
-    if (answer.status === 403) return { kind: "forbidden" };
     if (answer.status === 200) {
       const run = soleRun(answer.body);
-      if ("detail" in run) return { kind: "malformed", detail: run.detail };
+      if ("detail" in run) {
+        return { kind: "malformed", detail: run.detail };
+      }
       if (run.run !== null) {
         const read2 = readStages(run.run);
-        if (read2 === null) return { kind: "unavailable", reason: "no-stages" };
-        if ("malformed" in read2) return { kind: "malformed", detail: read2.malformed };
+        if (read2 === null) {
+          return { kind: "unavailable", reason: "no-stages" };
+        }
+        if ("malformed" in read2) {
+          return { kind: "malformed", detail: read2.malformed };
+        }
         last = read2.stages;
         let moved = false;
         for (const entry of read2.stages) {
-          if (entry.state === "pending" || seen.get(entry.stage) === entry.state) continue;
+          if (entry.state === "pending" || seen.get(entry.stage) === entry.state) {
+            continue;
+          }
           seen.set(entry.stage, entry.state);
           opts.onStage?.(entry);
           moved = true;
         }
-        if (isRecord2(run.run) && run.run["status"] === "awaiting-approval") return { kind: "waiting", stages: read2.stages };
+        if (isRecord3(run.run) && run.run["status"] === "awaiting-approval") {
+          return { kind: "waiting", stages: read2.stages };
+        }
         const end = ending(read2.stages);
         if (end !== null) {
-          const runId = isRecord2(run.run) && typeof run.run["runId"] === "string" ? run.run["runId"] : null;
+          const runId = isRecord3(run.run) && typeof run.run["runId"] === "string" ? run.run["runId"] : null;
           return { kind: "settled", ending: end, failedAt: read2.stages.find((s) => s.state === "failed")?.word ?? null, stages: read2.stages, runId };
         }
-        if (opts.untilChange === true && moved && answered) return { kind: "moving", stages: read2.stages };
+        if (opts.untilChange === true && moved && answered) {
+          return { kind: "moving", stages: read2.stages };
+        }
       }
       answered = true;
       lastError = null;
     } else {
       lastError = answer.status === 0 ? "the portal could not be reached" : `the portal answered ${answer.status}`;
     }
-    if (now() + interval2 > deadline) return { kind: "timed-out", stages: last, lastError };
+    if (now() + interval2 > deadline) {
+      return { kind: "timed-out", stages: last, lastError };
+    }
     await sleep2(interval2);
   }
 }
 function soleRun(body) {
-  if (!isRecord2(body) || !Array.isArray(body["runs"])) return { detail: "an answer with no list of runs" };
+  if (!isRecord3(body) || !Array.isArray(body["runs"])) {
+    return { detail: "an answer with no list of runs" };
+  }
   const runs = body["runs"];
-  if (runs.length > 1) return { detail: "more than the one run this publication started" };
+  if (runs.length > 1) {
+    return { detail: "more than the one run this publication started" };
+  }
   return { run: runs[0] ?? null };
 }
 async function ask(fetchImpl, url2, token) {
@@ -4842,7 +5325,9 @@ async function ask(fetchImpl, url2, token) {
     try {
       body = text ? JSON.parse(text) : null;
     } catch {
-      if (res.status === 200) return { status: 200, body: void 0 };
+      if (res.status === 200) {
+        return { status: 200, body: void 0 };
+      }
     }
     return { status: res.status, body };
   } catch {
@@ -4856,25 +5341,31 @@ function portalForEndpoint(endpoint) {
   } catch {
     return null;
   }
-  if (url2.protocol !== "https:" || url2.pathname.replace(/\/+$/, "") !== "/publish") return null;
+  if (url2.protocol !== "https:" || url2.pathname.replace(/\/+$/, "") !== "/publish") {
+    return null;
+  }
   return url2.origin;
 }
 var RUN_PROGRESS = "run-progress";
 async function confirmPortal(portal, endpoint, fetchImpl = fetch) {
   try {
     const res = await fetchImpl(`${portal}/api/v1/config`, { signal: AbortSignal.timeout(1e4) });
-    if (!res.ok) return null;
+    if (!res.ok) {
+      return null;
+    }
     const body = await res.json();
     const named = body?.publishingEndpoint;
     const bare = (u) => u.replace(/\/+$/, "");
-    if (typeof named !== "string" || bare(named) !== bare(endpoint)) return null;
+    if (typeof named !== "string" || bare(named) !== bare(endpoint)) {
+      return null;
+    }
     const terminal = body?.terminal;
     return { terminal: Array.isArray(terminal) && terminal.every((name) => typeof name === "string") ? terminal : [] };
   } catch {
     return null;
   }
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -4897,14 +5388,21 @@ async function call(input, opts, body) {
     const answer = await ask2(fetchImpl, url2, await opts.token(), body);
     if (answer.status === 401 && !refreshed && opts.refresh !== void 0) {
       refreshed = true;
-      if (await opts.refresh()) continue;
+      if (await opts.refresh()) {
+        continue;
+      }
+    }
+    if (answer.status === 401) {
+      return { kind: "unauthorized" };
+    }
+    if (answer.status === 403) {
+      return { kind: "forbidden" };
+    }
+    if (answer.status === 409) {
+      return { kind: "moved-on" };
     }
-    if (answer.status === 401) return { kind: "unauthorized" };
-    if (answer.status === 403) return { kind: "forbidden" };
-    if (answer.status === 409) return { kind: "moved-on" };
     if (answer.status === 404) {
-      const code = isRecord3(answer.body) ? answer.body["error"] : void 0;
-      return code === "no-such-application" ? { kind: "no-application" } : { kind: "unavailable", detail: "the portal does not serve this address" };
+      return portalRefusalCode(answer.body) === "no-such-application" ? { kind: "no-application" } : { kind: "unavailable", detail: "the portal does not serve this address" };
     }
     if (answer.status === 200) {
       const view = readView(answer.body);
@@ -4914,47 +5412,73 @@ async function call(input, opts, body) {
   }
 }
 function readView(body) {
-  if (!isRecord3(body)) return { detail: "an answer that is not a preparation" };
+  if (!isRecord4(body)) {
+    return { detail: "an answer that is not a preparation" };
+  }
   const { id, revision, status, message, questions, publication } = body;
-  if (typeof id !== "string" || id === "") return { detail: "a preparation with no id" };
-  if (typeof revision !== "number" || !Number.isSafeInteger(revision) || revision < 1) return { detail: "a preparation with no revision" };
-  if (!STATUSES.includes(status)) return { detail: "a preparation with an unknown status" };
-  if (typeof message !== "string") return { detail: "a preparation with no message" };
-  if (!Array.isArray(questions)) return { detail: "a preparation with no list of questions" };
+  if (typeof id !== "string" || id === "") {
+    return { detail: "a preparation with no id" };
+  }
+  if (typeof revision !== "number" || !Number.isSafeInteger(revision) || revision < 1) {
+    return { detail: "a preparation with no revision" };
+  }
+  if (!STATUSES.includes(status)) {
+    return { detail: "a preparation with an unknown status" };
+  }
+  if (typeof message !== "string") {
+    return { detail: "a preparation with no message" };
+  }
+  if (!Array.isArray(questions)) {
+    return { detail: "a preparation with no list of questions" };
+  }
   const read2 = [];
   for (const q of questions) {
-    if (!isRecord3(q) || typeof q["id"] !== "string" || typeof q["text"] !== "string" || !Array.isArray(q["options"]) || q["options"].length === 0) {
+    if (!isRecord4(q) || typeof q["id"] !== "string" || typeof q["text"] !== "string" || !Array.isArray(q["options"]) || q["options"].length === 0) {
       return { detail: "a question that cannot be answered" };
     }
     const options = [];
     for (const o of q["options"]) {
-      if (!isRecord3(o) || typeof o["value"] !== "string" || typeof o["label"] !== "string") return { detail: "a question with an unreadable option" };
+      if (!isRecord4(o) || typeof o["value"] !== "string" || typeof o["label"] !== "string") {
+        return { detail: "a question with an unreadable option" };
+      }
       options.push({ value: o["value"], label: o["label"] });
     }
     read2.push({ id: q["id"], text: q["text"], options });
   }
   let pub = null;
-  if (isRecord3(publication) && typeof publication["status"] === "string" && typeof publication["message"] === "string") {
+  if (isRecord4(publication) && typeof publication["status"] === "string" && typeof publication["message"] === "string") {
     pub = { status: publication["status"], message: publication["message"], ...typeof publication["url"] === "string" ? { url: publication["url"] } : {} };
   }
   return { id, revision, status, message, questions: read2, publication: pub, findings: readFindings(body["findings"]) };
 }
 function readFindings(value) {
-  if (!Array.isArray(value)) return [];
+  if (!Array.isArray(value)) {
+    return [];
+  }
   const out = [];
   const text = (v) => typeof v === "string" && v !== "" ? v.slice(0, MAX_TEXT) : void 0;
   for (const f of value) {
-    if (out.length === MAX_FINDINGS) break;
-    if (!isRecord3(f)) continue;
+    if (out.length === MAX_FINDINGS) {
+      break;
+    }
+    if (!isRecord4(f)) {
+      continue;
+    }
     const kind = text(f["kind"]);
     const fix = text(f["fix"]);
-    if (kind === void 0 || fix === void 0) continue;
+    if (kind === void 0 || fix === void 0) {
+      continue;
+    }
     const finding = { kind, fix };
     for (const field of ["url", "path", "message"]) {
       const value2 = text(f[field]);
-      if (value2 !== void 0) finding[field] = value2;
+      if (value2 !== void 0) {
+        finding[field] = value2;
+      }
+    }
+    if (typeof f["status"] === "number" && Number.isInteger(f["status"])) {
+      finding.status = f["status"];
     }
-    if (typeof f["status"] === "number" && Number.isInteger(f["status"])) finding.status = f["status"];
     out.push(finding);
   }
   return out;
@@ -4977,7 +5501,7 @@ async function ask2(fetchImpl, url2, token, body) {
     return { status: 0, body: null };
   }
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -5038,7 +5562,9 @@ async function onboardFolder(opts) {
   const extra = policy.exclude ?? [];
   const walk = async (d) => {
     for (const e of await (0, import_promises6.readdir)(d, { withFileTypes: true })) {
-      if (opts.signal?.aborted) throw new PublisherError("CANCELLED", "cancelled");
+      if (opts.signal?.aborted) {
+        throw new PublisherError("CANCELLED", "cancelled");
+      }
       const full = (0, import_node_path5.join)(d, e.name);
       const rel = (0, import_node_path5.relative)(dir, full).split(import_node_path5.sep).join("/");
       if (e.isSymbolicLink()) {
@@ -5053,7 +5579,9 @@ async function onboardFolder(opts) {
         await walk(full);
         continue;
       }
-      if (!e.isFile()) continue;
+      if (!e.isFile()) {
+        continue;
+      }
       if (excludedFile(rel, e.name, extra)) {
         excluded.push({ path: rel, reason: "excluded by policy" });
         continue;
@@ -5069,8 +5597,12 @@ async function onboardFolder(opts) {
   await walk(dir);
   const ignored = await checkIgnore(dir, candidates);
   const selected = candidates.filter((p) => !ignored.has(p)).sort();
-  for (const p of ignored) excluded.push({ path: p, reason: "ignored by .gitignore" });
-  if (selected.length === 0) return { repoDir: dir, commit: null, committed: [], excluded, initialized };
+  for (const p of ignored) {
+    excluded.push({ path: p, reason: "ignored by .gitignore" });
+  }
+  if (selected.length === 0) {
+    return { repoDir: dir, commit: null, committed: [], excluded, initialized };
+  }
   const commit = await commitPaths(dir, selected, {
     message: opts.message ?? "Initial publication",
     ...opts.authorName ? { authorName: opts.authorName } : {},
@@ -5087,7 +5619,9 @@ function excludedFile(rel, name, extra) {
 }
 async function recordChanges(opts) {
   const dir = opts.dir;
-  if (!await isGitRepo(dir)) throw new PublisherError("LOCAL_STATE", "this folder is not published yet; run publisher init first");
+  if (!await isGitRepo(dir)) {
+    throw new PublisherError("LOCAL_STATE", "this folder is not published yet; run publisher init first");
+  }
   const maxBytes = opts.policy?.maxFileBytes ?? 50 * 1024 * 1024;
   const extra = opts.policy?.exclude ?? [];
   const excluded = [];
@@ -5096,16 +5630,21 @@ async function recordChanges(opts) {
   if (await mergeInProgress(dir)) {
     const marked = [];
     for (const { code, path } of entries) {
-      if (!UNMERGED.has(code)) continue;
+      if (!UNMERGED.has(code)) {
+        continue;
+      }
       const text = await (0, import_promises6.readFile)((0, import_node_path5.join)(dir, path), "utf8").catch(() => "");
-      if (/^<{7} /m.test(text) && /^>{7} /m.test(text)) marked.push(path);
+      if (/^<{7} /m.test(text) && /^>{7} /m.test(text)) {
+        marked.push(path);
+      }
     }
-    if (marked.length)
+    if (marked.length) {
       throw new PublisherError(
         "LOCAL_STATE",
         `still marked as conflicting: ${marked.join(", ")}; keep one version (or both) in each, remove the <<<<<<< ======= >>>>>>> lines, then sync again`,
         { details: { marked } }
       );
+    }
   }
   for (const { code, path } of entries) {
     if (code !== "??") {
@@ -5136,7 +5675,9 @@ async function recordChanges(opts) {
     selected.push(path);
   }
   const unique = dedupe(excluded);
-  if (selected.length === 0) return { repoDir: dir, commit: null, committed: [], excluded: unique, initialized: false };
+  if (selected.length === 0) {
+    return { repoDir: dir, commit: null, committed: [], excluded: unique, initialized: false };
+  }
   const commit = await commitPaths(dir, selected.sort(), {
     message: opts.message ?? "Update",
     ...opts.authorName ? { authorName: opts.authorName } : {},
@@ -5163,9 +5704,13 @@ function matches(rel, base, pattern) {
   return base === pattern || rel === pattern || rel.startsWith(pattern.replace(/\/$/, "") + "/");
 }
 async function checkIgnore(dir, paths) {
-  if (paths.length === 0) return /* @__PURE__ */ new Set();
+  if (paths.length === 0) {
+    return /* @__PURE__ */ new Set();
+  }
   const r = await runGit(["check-ignore", "--stdin", "-z"], { cwd: dir, input: paths.join("\0") + "\0", allowFailure: true });
-  if (r.code !== 0) return /* @__PURE__ */ new Set();
+  if (r.code !== 0) {
+    return /* @__PURE__ */ new Set();
+  }
   return new Set(r.stdout.toString("utf8").split("\0").filter(Boolean));
 }
 
@@ -5185,7 +5730,9 @@ var import_promises7 = require("node:fs/promises");
 var import_node_fs5 = require("node:fs");
 var import_node_stream = require("node:stream");
 async function uploadPack(fetchImpl, upload, packPath, size, opts) {
-  if (new Date(upload.expiresAt).getTime() < Date.now() + 5e3) return "expired";
+  if (new Date(upload.expiresAt).getTime() < Date.now() + 5e3) {
+    return "expired";
+  }
   let sent = 0;
   const file = (0, import_node_fs5.createReadStream)(packPath);
   const progress = new TransformStream({
@@ -5206,16 +5753,27 @@ async function uploadPack(fetchImpl, upload, packPath, size, opts) {
       ...opts.signal ? { signal: opts.signal } : {}
     });
   } catch (e) {
-    if (opts.signal?.aborted) throw new PublisherError("CANCELLED", "upload cancelled");
+    if (opts.signal?.aborted) {
+      throw new PublisherError("CANCELLED", "upload cancelled");
+    }
     throw new PublisherError("NETWORK", `upload failed: ${e.message}`, { retryable: true, cause: e });
   }
-  if (res.ok) return "uploaded";
+  if (res.ok) {
+    return "uploaded";
+  }
   const text = await res.text().catch(() => "");
-  if (res.status === 412) return "already-present";
-  if (res.status === 403 && /expired|Request has expired|AccessDenied/i.test(text)) return "expired";
-  if (res.status === 400 && /checksum|Content-MD5|BadDigest|XAmzContentSHA256Mismatch/i.test(text))
+  if (res.status === 412) {
+    return "already-present";
+  }
+  if (res.status === 403 && /expired|Request has expired|AccessDenied/i.test(text)) {
+    return "expired";
+  }
+  if (res.status === 400 && /checksum|Content-MD5|BadDigest|XAmzContentSHA256Mismatch/i.test(text)) {
     throw new PublisherError("UPLOAD_MISMATCH", "storage rejected the pack checksum");
-  if (res.status >= 500 || res.status === 429) throw new PublisherError("NETWORK", `upload failed with HTTP ${res.status}`, { retryable: true });
+  }
+  if (res.status >= 500 || res.status === 429) {
+    throw new PublisherError("NETWORK", `upload failed with HTTP ${res.status}`, { retryable: true });
+  }
   throw new PublisherError("NETWORK", `upload failed with HTTP ${res.status}`);
 }
 
@@ -5233,12 +5791,19 @@ async function publish(ctx, repoId, remote, opts, call2) {
   try {
     refUpdates = await resolveUpdates(repoDir, repo, specs);
   } catch (e) {
-    if (e instanceof PublisherError && e.code === "LOCAL_STATE" && /nothing to publish/.test(e.message)) nothingNew = e;
-    else throw e;
+    if (e instanceof PublisherError && e.code === "LOCAL_STATE" && /nothing to publish/.test(e.message)) {
+      nothingNew = e;
+    } else {
+      throw e;
+    }
   }
   for (const pending2 of pendings) {
-    if (pending2.repoId !== repoId) continue;
-    if (opts.publicationId && pending2.publicationId !== opts.publicationId) continue;
+    if (pending2.repoId !== repoId) {
+      continue;
+    }
+    if (opts.publicationId && pending2.publicationId !== opts.publicationId) {
+      continue;
+    }
     const sameIntent = !nothingNew && pending2.baseGeneration === repo.generation && canonicalJson(refUpdates) === canonicalJson(pending2.refUpdates);
     if (sameIntent && (pending2.pack === null || await packFileUsable(pending2))) {
       progress({ phase: "resolve", message: `resuming publication ${pending2.publicationId}` });
@@ -5257,13 +5822,19 @@ async function publish(ctx, repoId, remote, opts, call2) {
       try {
         remaining = await resolveUpdates(repoDir, fresh, specs);
       } catch (e) {
-        if (!(e instanceof PublisherError && e.code === "LOCAL_STATE")) throw e;
+        if (!(e instanceof PublisherError && e.code === "LOCAL_STATE")) {
+          throw e;
+        }
+      }
+      if (remaining.length === 0) {
+        return toOutcome(outcome, true, pending2.refUpdates);
       }
-      if (remaining.length === 0) return toOutcome(outcome, true, pending2.refUpdates);
       return publish(ctx, repoId, remote, opts, call2);
     }
   }
-  if (nothingNew) throw nothingNew;
+  if (nothingNew) {
+    throw nothingNew;
+  }
   const remoteOids = new Set(Object.values(repo.refs));
   const wants = refUpdates.map((u) => u.new).filter((o) => o !== null);
   const needsPack = wants.some((o) => !remoteOids.has(o));
@@ -5272,7 +5843,11 @@ async function publish(ctx, repoId, remote, opts, call2) {
   if (needsPack) {
     progress({ phase: "pack", message: "packing objects" });
     const exclude = [];
-    for (const info of await batchCheck(repoDir, remoteOids)) if (info.type !== "missing") exclude.push(info.oid);
+    for (const info of await batchCheck(repoDir, remoteOids)) {
+      if (info.type !== "missing") {
+        exclude.push(info.oid);
+      }
+    }
     const outPath = store2.packPath(publicationId);
     const built = await buildPack(repoDir, { include: wants, exclude, outPath, ...call2.signal ? { signal: call2.signal } : {} });
     pack = { sha256: built.sha256, size: built.size, path: outPath };
@@ -5293,7 +5868,9 @@ async function publish(ctx, repoId, remote, opts, call2) {
   return runPublication(ctx, repoId, remote, repoDir, store2, pending, opts, call2, false);
 }
 async function packFileUsable(p) {
-  if (!p.pack) return true;
+  if (!p.pack) {
+    return true;
+  }
   try {
     const h = await sha256File(p.pack.path);
     return h.sha256 === p.pack.sha256 && h.size === p.pack.size;
@@ -5310,8 +5887,12 @@ async function runPublication(ctx, repoId, remote, repoDir, store2, pending, opt
 }
 var UNCONFIRMED = /* @__PURE__ */ new Set(["UNAUTHORIZED", "FORBIDDEN", "NETWORK", "UNAVAILABLE", "INTERNAL"]);
 function unconfirmed(e, publicationId) {
-  if (!(e instanceof PublisherError) || !UNCONFIRMED.has(e.code)) return e;
-  if (e.code === "UNAUTHORIZED" && e.details?.["signIn"] !== void 0) return e;
+  if (!(e instanceof PublisherError) || !UNCONFIRMED.has(e.code)) {
+    return e;
+  }
+  if (e.code === "UNAUTHORIZED" && e.details?.["signIn"] !== void 0) {
+    return e;
+  }
   return new PublisherError("OUTCOME_UNKNOWN", `publication ${publicationId} was not confirmed (${e.code}: ${e.message}); run status before publishing again`, {
     retryable: true,
     cause: e,
@@ -5338,9 +5919,13 @@ async function sendAndWait(ctx, repoId, remote, repoDir, store2, pending, opts,
         let result = await uploadPack(ctx.fetchImpl, begin.upload, pending.pack.path, pending.pack.size, call2);
         if (result === "expired") {
           begin = (await ctx.transport.request("POST", `/v1/repos/${repoId}/publications`, beginBody, call2)).body;
-          if (!begin.upload) throw new PublisherError("UPLOAD_MISSING", "server did not return fresh upload instructions");
+          if (!begin.upload) {
+            throw new PublisherError("UPLOAD_MISSING", "server did not return fresh upload instructions");
+          }
           result = await uploadPack(ctx.fetchImpl, begin.upload, pending.pack.path, pending.pack.size, call2);
-          if (result === "expired") throw new PublisherError("NETWORK", "upload authorization expired twice", { retryable: true });
+          if (result === "expired") {
+            throw new PublisherError("NETWORK", "upload authorization expired twice", { retryable: true });
+          }
         }
       }
       progress({ phase: "finalize", message: "finalizing" });
@@ -5362,7 +5947,9 @@ async function sendAndWait(ctx, repoId, remote, repoDir, store2, pending, opts,
     progress({ phase: "done", message: `published generation ${summary.resultGeneration}` });
   } else if (summary.state === "rejected") {
     await store2.remove(pending.publicationId);
-    if (pending.pack) await (0, import_promises7.rm)(pending.pack.path, { force: true });
+    if (pending.pack) {
+      await (0, import_promises7.rm)(pending.pack.path, { force: true });
+    }
   }
   return toOutcome(summary, resumed, pending.refUpdates);
 }
@@ -5371,7 +5958,9 @@ async function waitForOutcome(ctx, repoId, publicationId, timeoutMs, call2) {
   let delay2 = 500;
   for (; ; ) {
     const s = await ctx.getStatus(repoId, publicationId, { ...call2, waitSeconds: MAX_WAIT_SECONDS });
-    if (s.state === "accepted" || s.state === "rejected") return s;
+    if (s.state === "accepted" || s.state === "rejected") {
+      return s;
+    }
     if (Date.now() > deadline) {
       throw new PublisherError("OUTCOME_UNKNOWN", `publication ${publicationId} has not completed yet; run status later`, { retryable: true, details: { publicationId } });
     }
@@ -5427,7 +6016,9 @@ function toOutcome(s, resumed, updates) {
 }
 var REF_MOVED = /* @__PURE__ */ new Set(["NON_FAST_FORWARD", "EXPECTED_OLD_MISMATCH", "STALE_GENERATION"]);
 function publishNext(rejection, published) {
-  if (rejection === null || !REF_MOVED.has(rejection.code)) return null;
+  if (rejection === null || !REF_MOVED.has(rejection.code)) {
+    return null;
+  }
   const named = rejection.details?.["ref"];
   const ref = typeof named === "string" ? named : published;
   const name = ref?.replace(/^refs\/heads\//, "") ?? "main";
@@ -5439,7 +6030,9 @@ function publishNext(rejection, published) {
 }
 async function defaultUpdate(repoDir) {
   const branch = await currentBranch(repoDir);
-  if (!branch) throw new PublisherError("LOCAL_STATE", "detached HEAD: specify which ref to publish");
+  if (!branch) {
+    throw new PublisherError("LOCAL_STATE", "detached HEAD: specify which ref to publish");
+  }
   return { ref: branch };
 }
 async function resolveUpdates(repoDir, repo, specs) {
@@ -5451,31 +6044,48 @@ async function resolveUpdates(repoDir, repo, specs) {
   );
   let i = 0;
   for (const spec of specs) {
-    if (!spec.ref.startsWith("refs/")) throw new PublisherError("INVALID_REQUEST", `ref must be fully qualified: ${spec.ref}`);
+    if (!spec.ref.startsWith("refs/")) {
+      throw new PublisherError("INVALID_REQUEST", `ref must be fully qualified: ${spec.ref}`);
+    }
     let target;
-    if (spec.to === null) target = null;
-    else {
+    if (spec.to === null) {
+      target = null;
+    } else {
       const r = resolved[i++] ?? null;
-      if (r instanceof PublisherError) throw r;
+      if (r instanceof PublisherError) {
+        throw r;
+      }
       target = r;
-      if (!target) throw new PublisherError("LOCAL_STATE", `cannot resolve ${spec.to ?? spec.ref} in ${repoDir}`);
+      if (!target) {
+        throw new PublisherError("LOCAL_STATE", `cannot resolve ${spec.to ?? spec.ref} in ${repoDir}`);
+      }
     }
     const expectedOld = repo.refs[spec.ref] ?? null;
-    if (target === null && expectedOld === null) throw new PublisherError("INVALID_REQUEST", `${spec.ref} does not exist on the server`);
-    if (target !== null && target === expectedOld) continue;
+    if (target === null && expectedOld === null) {
+      throw new PublisherError("INVALID_REQUEST", `${spec.ref} does not exist on the server`);
+    }
+    if (target !== null && target === expectedOld) {
+      continue;
+    }
     out.push({ ref: spec.ref, expectedOld, new: target, force: spec.force ?? false });
   }
-  if (out.length === 0) throw new PublisherError("LOCAL_STATE", "nothing to publish: the server already has these refs");
+  if (out.length === 0) {
+    throw new PublisherError("LOCAL_STATE", "nothing to publish: the server already has these refs");
+  }
   return out;
 }
 async function applyTrackingRefs(repoDir, remote, updates) {
   for (const u of updates) {
     const tracking = trackingRef(remote, u.ref);
-    if (tracking) await updateTrackingRef(repoDir, tracking, u.new);
+    if (tracking) {
+      await updateTrackingRef(repoDir, tracking, u.new);
+    }
   }
 }
 function trackingRef(remote, ref) {
-  if (ref.startsWith("refs/heads/")) return `refs/remotes/${remote}/${ref.slice("refs/heads/".length)}`;
+  if (ref.startsWith("refs/heads/")) {
+    return `refs/remotes/${remote}/${ref.slice("refs/heads/".length)}`;
+  }
   return null;
 }
 
@@ -5518,7 +6128,9 @@ async function fetchRepository(ctx, repoId, opts, call2) {
         artifacts.filter((a) => installed.has(a.sha256)),
         call2
       );
-      if (!await haveAll(opts.repoDir, body.refs)) throw new PublisherError("NETWORK", "the downloaded artifacts do not contain every advertised ref", { retryable: true });
+      if (!await haveAll(opts.repoDir, body.refs)) {
+        throw new PublisherError("NETWORK", "the downloaded artifacts do not contain every advertised ref", { retryable: true });
+      }
     }
   }
   await writeManifest(
@@ -5531,11 +6143,15 @@ async function fetchRepository(ctx, repoId, opts, call2) {
 }
 async function haveAll(repoDir, refs) {
   const oids = new Set(Object.values(refs));
-  if (oids.size === 0) return true;
+  if (oids.size === 0) {
+    return true;
+  }
   return (await batchCheck(repoDir, oids)).every((o) => o.type !== "missing");
 }
 async function install(ctx, gd, artifacts, call2) {
-  if (artifacts.length === 0) return 0;
+  if (artifacts.length === 0) {
+    return 0;
+  }
   const progress = call2.onProgress ?? (() => void 0);
   const tmp = await (0, import_promises8.mkdtemp)((0, import_node_path6.join)((0, import_node_os3.tmpdir)(), "gitpub-fetch-"));
   let bytes = 0;
@@ -5565,12 +6181,18 @@ async function updateRefs(repoDir, remote, refs) {
     const t = trackingRef(remote, ref);
     if (t) {
       tracking[t] = oid;
-      if (before[t] !== oid) updates.push({ ref: t, new: oid });
+      if (before[t] !== oid) {
+        updates.push({ ref: t, new: oid });
+      }
     } else if (ref.startsWith("refs/tags/") && !(ref in before)) {
       updates.push({ ref, new: oid });
     }
   }
-  for (const ref of Object.keys(before)) if (ref.startsWith(prefix) && !(ref in tracking)) updates.push({ ref, new: null });
+  for (const ref of Object.keys(before)) {
+    if (ref.startsWith(prefix) && !(ref in tracking)) {
+      updates.push({ ref, new: null });
+    }
+  }
   await refTransaction(repoDir, updates);
   return tracking;
 }
@@ -5581,7 +6203,9 @@ async function download(fetchImpl, url2, dest, sha256, size, call2) {
   } catch (e) {
     throw new PublisherError("NETWORK", `download failed: ${e.message}`, { retryable: true, cause: e });
   }
-  if (!res.ok || !res.body) throw new PublisherError("NETWORK", `download failed with HTTP ${res.status}`, { retryable: res.status >= 500 });
+  if (!res.ok || !res.body) {
+    throw new PublisherError("NETWORK", `download failed with HTTP ${res.status}`, { retryable: res.status >= 500 });
+  }
   const hash = (0, import_node_crypto4.createHash)("sha256");
   let n = 0;
   const counted = new TransformStream({
@@ -5593,7 +6217,9 @@ async function download(fetchImpl, url2, dest, sha256, size, call2) {
     }
   });
   await (0, import_promises9.pipeline)(import_node_stream2.Readable.fromWeb(res.body.pipeThrough(counted)), (0, import_node_fs6.createWriteStream)(dest));
-  if (n !== size || hash.digest("hex") !== sha256) throw new PublisherError("NETWORK", "downloaded artifact failed checksum verification", { retryable: true });
+  if (n !== size || hash.digest("hex") !== sha256) {
+    throw new PublisherError("NETWORK", "downloaded artifact failed checksum verification", { retryable: true });
+  }
   return n;
 }
 
@@ -5603,7 +6229,9 @@ var CLIENT_VERSION = "0.1.0";
 async function markConflicts(dir, remote) {
   const who = { GIT_AUTHOR_NAME: "Publisher", GIT_AUTHOR_EMAIL: "publisher@localhost", GIT_COMMITTER_NAME: "Publisher", GIT_COMMITTER_EMAIL: "publisher@localhost" };
   const r = await runGit(["merge", "--no-ff", "--no-commit", "--no-verify", remote], { cwd: dir, env: { extra: who }, allowFailure: true });
-  if (r.code !== 0 && !await mergeInProgress(dir)) throw new PublisherError("GIT", `could not mark the conflicts: ${r.stderr.trim()}`);
+  if (r.code !== 0 && !await mergeInProgress(dir)) {
+    throw new PublisherError("GIT", `could not mark the conflicts: ${r.stderr.trim()}`);
+  }
 }
 var Publisher = class {
   constructor(opts) {
@@ -5692,9 +6320,15 @@ var Publisher = class {
   /** One page of the repositories the caller created (ADR-0011). An authenticated route, unlike capabilities. */
   async listRepositories(options = {}, call2 = {}) {
     const q = new URLSearchParams();
-    if (options.state) q.set("state", options.state);
-    if (options.limit !== void 0) q.set("limit", String(options.limit));
-    if (options.cursor) q.set("cursor", options.cursor);
+    if (options.state) {
+      q.set("state", options.state);
+    }
+    if (options.limit !== void 0) {
+      q.set("limit", String(options.limit));
+    }
+    if (options.cursor) {
+      q.set("cursor", options.cursor);
+    }
     const qs = q.toString() ? `?${q.toString()}` : "";
     return (await this.transport.request("GET", `/v1/repos${qs}`, void 0, call2)).body;
   }
@@ -5719,8 +6353,12 @@ var Publisher = class {
   }
   async resolveRepo(repoDir, repoId) {
     const a = await readAssociation(repoDir);
-    if (repoId) return { repoId, remote: a?.remote ?? "publisher" };
-    if (!a) throw new PublisherError("LOCAL_STATE", "this folder is not associated with a published repository; run init first");
+    if (repoId) {
+      return { repoId, remote: a?.remote ?? "publisher" };
+    }
+    if (!a) {
+      throw new PublisherError("LOCAL_STATE", "this folder is not associated with a published repository; run init first");
+    }
     if (a.endpoint !== this.endpoint) {
       throw new PublisherError(
         "LOCAL_STATE",
@@ -5772,20 +6410,27 @@ var Publisher = class {
     const dir = options.directory;
     await this.resolveRepo(dir);
     const branch = (await currentBranch(dir))?.replace(/^refs\/heads\//, "") ?? null;
-    if (!branch) throw new PublisherError("LOCAL_STATE", "HEAD is detached; check out the branch this folder publishes, then run sync again");
+    if (!branch) {
+      throw new PublisherError("LOCAL_STATE", "HEAD is detached; check out the branch this folder publishes, then run sync again");
+    }
     const mapped = await getWorkspaceMapping(dir);
-    if (mapped && mapped.branch !== branch)
+    if (mapped && mapped.branch !== branch) {
       throw new PublisherError("LOCAL_STATE", `branch ${branch} is checked out, but this folder publishes ${mapped.branch}; check it out, then run sync again`);
+    }
     const recorded = await recordChanges({ dir, ...options.message ? { message: options.message } : {} });
     const reconciled = await syncWorkspace(this, { directory: dir, apply: true }, call2);
     const base = { recorded: { commit: recorded.commit, committed: recorded.committed, excluded: recorded.excluded }, reconciled };
     if (reconciled.after === "conflict") {
       const remote = reconciled.before.remote?.oid ?? null;
-      if (options.markConflicts && remote) await markConflicts(dir, remote);
+      if (options.markConflicts && remote) {
+        await markConflicts(dir, remote);
+      }
       return { ...base, state: "conflict", published: null, marked: options.markConflicts === true && remote !== null };
     }
     const tip = await revParse(dir, `refs/heads/${branch}`);
-    if (tip === null || tip === (reconciled.before.remote?.oid ?? null)) return { ...base, state: "up_to_date", published: null, marked: false };
+    if (tip === null || tip === (reconciled.before.remote?.oid ?? null)) {
+      return { ...base, state: "up_to_date", published: null, marked: false };
+    }
     const published = await this.publish({ repoDir: dir }, call2);
     return { ...base, state: published.state === "accepted" ? "published" : published.state === "rejected" ? "rejected" : "unknown", published, marked: false };
   }
@@ -5795,7 +6440,9 @@ var Publisher = class {
     const out = [];
     const store2 = await openPending(repoDir);
     for (const p of await store2.list()) {
-      if (p.endpoint !== this.endpoint) continue;
+      if (p.endpoint !== this.endpoint) {
+        continue;
+      }
       if (!p.finalized) {
         out.push(await publish(this.publishContext(), p.repoId, remote, { repoDir, publicationId: p.publicationId }, call2).catch((e) => rethrowUnlessResolvable(e, p)));
         continue;
@@ -5808,7 +6455,9 @@ var Publisher = class {
       }
       out.push(toOutcome(s, true, p.refUpdates));
     }
-    for (const o of out) await noteAcceptedPublication(repoDir, o);
+    for (const o of out) {
+      await noteAcceptedPublication(repoDir, o);
+    }
     return out;
   }
   async pendingPublications(repoDir) {
@@ -5834,8 +6483,9 @@ var Publisher = class {
   }
 };
 function rethrowUnlessResolvable(e, p) {
-  if (e instanceof PublisherError)
+  if (e instanceof PublisherError) {
     throw new PublisherError(e.code, `publication ${p.publicationId}: ${e.message}`, { retryable: e.retryable, details: { ...e.details ?? {}, publicationId: p.publicationId } });
+  }
   throw e;
 }
 function createPublisher(opts) {
@@ -5843,19 +6493,28 @@ function createPublisher(opts) {
 }
 
 // ../client/src/migrate.ts
-async function fetchCapabilities(endpoint, fetchImpl = fetch, signal) {
-  const res = await fetchImpl(`${normalize(endpoint)}/v1/capabilities`, { method: "GET", ...signal ? { signal } : {} });
-  if (!res.ok) throw new Error(`answered ${res.status}`);
-  return await res.json();
+var CAPABILITIES_TIMEOUT_MS = 1e4;
+async function fetchCapabilities(endpoint, fetchImpl = fetch, opts = {}) {
+  const bound = new AbortController();
+  const timer = setTimeout(() => bound.abort(new DOMException("the capabilities request timed out", "TimeoutError")), opts.timeoutMs ?? CAPABILITIES_TIMEOUT_MS);
+  const signal = opts.signal ? AbortSignal.any([opts.signal, bound.signal]) : bound.signal;
+  try {
+    const res = await fetchImpl(`${normalize(endpoint)}/v1/capabilities`, { method: "GET", signal });
+    if (!res.ok) {
+      throw new Error(`answered ${res.status}`);
+    }
+    return await res.json();
+  } finally {
+    clearTimeout(timer);
+  }
 }
 async function probeEndpoint(endpoint, opts = {}) {
   const from = normalize(endpoint);
-  const signal = AbortSignal.timeout(opts.timeoutMs ?? 1e4);
   let advertised;
   try {
-    advertised = (await fetchCapabilities(from, opts.fetch, signal)).endpoints?.control;
+    advertised = (await fetchCapabilities(from, opts.fetch, opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {})).endpoints?.control;
   } catch (e) {
-    return { kind: "unreachable", reason: signal.aborted ? "timed out" : e.message };
+    return { kind: "unreachable", reason: e.name === "TimeoutError" ? "timed out" : e.message };
   }
   if (typeof advertised !== "string" || advertised === "") {
     return { kind: "unreachable", reason: "it advertises no control endpoint" };
@@ -5904,16 +6563,22 @@ async function startDeviceLogin(opts) {
   } catch (e) {
     throw new PublisherError("UNAVAILABLE", `could not reach ${control}: ${e instanceof Error ? e.message : String(e)}`, { retryable: true });
   }
-  if (typeof advertised !== "string" || advertised === "") throw new PublisherError("UNAVAILABLE", "this deployment does not offer device login; obtain a token another way");
+  if (typeof advertised !== "string" || advertised === "") {
+    throw new PublisherError("UNAVAILABLE", "this deployment does not offer device login; obtain a token another way");
+  }
   const base = normalize(advertised);
   assertCredentialEndpoint(base);
   const started = await postForm(base, "/v1/auth/device", { client_id: opts.clientId ?? "gitpub-cli" }, doFetch);
-  if (started.status !== 200) throw new PublisherError("UNAVAILABLE", `starting the login failed (${started.status})`, { retryable: true });
+  if (started.status !== 200) {
+    throw new PublisherError("UNAVAILABLE", `starting the login failed (${started.status})`, { retryable: true });
+  }
   const s = started.body;
   const deviceCode = str(s.device_code);
   const userCode = str(s.user_code);
   const uri = str(s.verification_uri_complete) ?? str(s.verification_uri);
-  if (!deviceCode || !userCode || !uri) throw new PublisherError("UNAVAILABLE", "the login response was incomplete");
+  if (!deviceCode || !userCode || !uri) {
+    throw new PublisherError("UNAVAILABLE", "the login response was incomplete");
+  }
   const expiresInSeconds = num(s.expires_in, 600);
   return {
     deviceCode,
@@ -5933,25 +6598,41 @@ async function pollDeviceLogin(started, opts) {
   let last = opts.lastPolledAt;
   for (; ; ) {
     const at = Math.max(now(), last === null ? 0 : last + intervalMs);
-    if (opts.until !== void 0 && at > opts.until) return null;
-    if (at > now()) await sleep2(at - now());
-    if (now() >= started.expiresAt) throw new PublisherError("EXPIRED", "the login expired before it was approved");
+    if (opts.until !== void 0 && at > opts.until) {
+      return null;
+    }
+    if (at > now()) {
+      await sleep2(at - now());
+    }
+    if (now() >= started.expiresAt) {
+      throw new PublisherError("EXPIRED", "the login expired before it was approved");
+    }
     const polled = await postForm(started.authEndpoint, "/v1/auth/token", { grant_type: DEVICE_CODE_GRANT, device_code: started.deviceCode }, doFetch);
     last = now();
     if (polled.status === 200) {
       const token = str(polled.body["access_token"]);
-      if (!token) throw new PublisherError("UNAVAILABLE", "the login returned no credential");
+      if (!token) {
+        throw new PublisherError("UNAVAILABLE", "the login returned no credential");
+      }
       return { token, refreshToken: str(polled.body["refresh_token"]), expiresInSeconds: num(polled.body["expires_in"], 900), authEndpoint: started.authEndpoint };
     }
     const error2 = str(polled.body["error"]);
-    if (error2 === "authorization_pending") continue;
+    if (error2 === "authorization_pending") {
+      continue;
+    }
     if (error2 === "slow_down") {
       intervalMs += 5e3;
       continue;
     }
-    if (error2 === "access_denied") throw new PublisherError("FORBIDDEN", "the login was refused");
-    if (error2 === "expired_token") throw new PublisherError("EXPIRED", "the login expired before it was approved");
-    if (polled.status >= 500) continue;
+    if (error2 === "access_denied") {
+      throw new PublisherError("FORBIDDEN", "the login was refused");
+    }
+    if (error2 === "expired_token") {
+      throw new PublisherError("EXPIRED", "the login expired before it was approved");
+    }
+    if (polled.status >= 500) {
+      continue;
+    }
     throw new PublisherError("UNAVAILABLE", `the login failed (${polled.status}${error2 ? `: ${error2}` : ""})`);
   }
 }
@@ -5979,11 +6660,17 @@ async function readPendingLogin() {
   } catch {
     return null;
   }
-  if (typeof raw !== "object" || raw === null) return null;
+  if (typeof raw !== "object" || raw === null) {
+    return null;
+  }
   const r = raw;
   const s = r.started;
-  if (r.version !== 1 || typeof r.endpoint !== "string" || !s) return null;
-  if (typeof s.deviceCode !== "string" || typeof s.authEndpoint !== "string" || typeof s.expiresAt !== "number" || typeof s.intervalSeconds !== "number") return null;
+  if (r.version !== 1 || typeof r.endpoint !== "string" || !s) {
+    return null;
+  }
+  if (typeof s.deviceCode !== "string" || typeof s.authEndpoint !== "string" || typeof s.expiresAt !== "number" || typeof s.intervalSeconds !== "number") {
+    return null;
+  }
   return {
     endpoint: r.endpoint,
     started: s,
@@ -6012,7 +6699,9 @@ var HEARTBEAT_MS = 3e4;
 var SPINNER = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 function took(ms) {
   const seconds = Math.max(0, Math.floor(ms / 1e3));
-  if (seconds < 60) return `${seconds} s`;
+  if (seconds < 60) {
+    return `${seconds} s`;
+  }
   const minutes = Math.floor(seconds / 60);
   return minutes >= 10 ? `${minutes} min` : `${minutes} min ${String(seconds % 60).padStart(2, "0")} s`;
 }
@@ -6044,7 +6733,9 @@ function stageReporter(io) {
   let drawn = false;
   let receivedAt = null;
   const clear = () => {
-    if (drawn) io.write("\r\x1B[2K");
+    if (drawn) {
+      io.write("\r\x1B[2K");
+    }
     drawn = false;
   };
   const stopTicking = () => {
@@ -6058,14 +6749,21 @@ function stageReporter(io) {
   };
   return {
     onStage(e) {
-      if (e.state === "in-progress" || ticking?.stage === e.stage) stopTicking();
-      else clear();
+      if (e.state === "in-progress" || ticking?.stage === e.stage) {
+        stopTicking();
+      } else {
+        clear();
+      }
       const says = SAYS[e.stage];
-      if (e.stage === "received" && e.at !== null) receivedAt = since(e);
+      if (e.stage === "received" && e.at !== null) {
+        receivedAt = since(e);
+      }
       if (e.state !== "in-progress") {
         const total = e.stage === "live" && e.state === "done" && receivedAt !== null ? ` (${took(since(e) - receivedAt)} after Shadow received it)` : "";
         const line = settledLine(e, total);
-        if (line !== null) io.write(line);
+        if (line !== null) {
+          io.write(line);
+        }
         return;
       }
       io.write(`  \u2026 ${e.word.padEnd(10)} ${says.doing}
@@ -6094,13 +6792,17 @@ async function followPublication(p, endpoint, o, opts) {
   const confirmed = derived === null ? null : await confirmPortal(derived, endpoint, opts.fetch);
   const portal = confirmed === null ? null : derived;
   const elsewhere = (reason) => ({ kind: "unavailable", reason, portal, hint: inPortal(portal, "Published.", "Follow it") });
-  if (portal === null || confirmed === null) return elsewhere("no-portal");
+  if (portal === null || confirmed === null) {
+    return elsewhere("no-portal");
+  }
   if (!confirmed.terminal.includes(RUN_PROGRESS)) {
     const noRoute = { kind: "unavailable", reason: "no-route" };
     return { ...noRoute, portal, hint: progressHint(noRoute, portal) };
   }
   const refs = Object.entries(o.refs ?? {});
-  if (refs.length !== 1) return elsewhere("several-refs");
+  if (refs.length !== 1) {
+    return elsewhere("several-refs");
+  }
   const [ref, commit] = refs[0];
   opts.log("Following it to live: received -> checked -> going live -> live. Ctrl-C stops watching; the publication is saved and carries on without you.");
   const outcome = await p.followRun(
@@ -6123,19 +6825,29 @@ async function followPublication(p, endpoint, o, opts) {
   return { ...outcome, portal, hint: progressHint(outcome, portal, answerable), ...next === void 0 ? {} : { next } };
 }
 async function failedChecks(p, portal, repoId, outcome, served) {
-  if (!served || outcome.kind !== "settled" || outcome.ending !== "failed" || outcome.runId === null) return null;
-  if (outcome.stages.find((s) => s.state === "failed")?.stage !== "running") return null;
+  if (!served || outcome.kind !== "settled" || outcome.ending !== "failed" || outcome.runId === null) {
+    return null;
+  }
+  if (outcome.stages.find((s) => s.state === "failed")?.stage !== "running") {
+    return null;
+  }
   try {
     const answer = await p.readPreparation({ portal, repoId });
-    if (answer.kind !== "view" || answer.view.id !== outcome.runId || answer.view.status !== "blocked") return null;
+    if (answer.kind !== "view" || answer.view.id !== outcome.runId || answer.view.status !== "blocked") {
+      return null;
+    }
     return answer.view.findings.length === 0 ? null : answer.view.findings;
   } catch {
     return null;
   }
 }
 function followTimeoutMs(flag) {
-  if (flag === void 0) return FOLLOW_TIMEOUT_MS;
-  if (!/^[1-9][0-9]*$/.test(flag)) throw new PublisherError("INVALID_REQUEST", `--timeout takes a whole number of seconds, not ${JSON.stringify(flag)}`);
+  if (flag === void 0) {
+    return FOLLOW_TIMEOUT_MS;
+  }
+  if (!/^[1-9][0-9]*$/.test(flag)) {
+    throw new PublisherError("INVALID_REQUEST", `--timeout takes a whole number of seconds, not ${JSON.stringify(flag)}`);
+  }
   return Math.min(Number(flag) * 1e3, FOLLOW_TIMEOUT_MS);
 }
 function shellWord(path) {
@@ -6144,8 +6856,12 @@ function shellWord(path) {
 function stageEmitter(json, quiet) {
   const nothing = () => {
   };
-  if (json) return { onStage: (e) => process.stdout.write(stageLine(e) + "\n"), stopStages: nothing };
-  if (quiet) return { onStage: nothing, stopStages: nothing };
+  if (json) {
+    return { onStage: (e) => process.stdout.write(stageLine(e) + "\n"), stopStages: nothing };
+  }
+  if (quiet) {
+    return { onStage: nothing, stopStages: nothing };
+  }
   const { onStage, stop } = stageReporter({ write: (s) => process.stderr.write(s), isTTY: process.stderr.isTTY === true });
   return { onStage, stopStages: stop };
 }
@@ -6210,7 +6926,9 @@ function folderFor(name) {
 // src/init.ts
 async function repositoryForInit(p, endpoint, name, opts = {}) {
   const portal = portalForEndpoint(endpoint);
-  if (portal === null) return { repoId: (await p.createRepository({ name, grants: [] })).repoId, appId: null };
+  if (portal === null) {
+    return { repoId: (await p.createRepository({ name, grants: [] })).repoId, appId: null };
+  }
   const confirmed = await confirmPortal(portal, endpoint, opts.fetch);
   if (confirmed === null) {
     throw new PublisherError("UNAVAILABLE", `could not confirm that ${portal} publishes to ${endpoint}; run init again`, { retryable: true });
@@ -6272,18 +6990,25 @@ var DEFAULT_PORTAL_URL = "https://shadow.minnovate.ai";
 function portalBase(env, flag) {
   return (flag ?? env["GIT_PUBLISHER_PORTAL"] ?? DEFAULT_PORTAL_URL).replace(/\/+$/, "");
 }
+var DISCOVER_TIMEOUT_MS = 1e4;
 async function discoverEndpoint(portal, fetchImpl = fetch) {
   const url2 = `${portal}/api/v1/config`;
+  const bound = new AbortController();
+  const timer = setTimeout(() => bound.abort(new DOMException("the request timed out", "TimeoutError")), DISCOVER_TIMEOUT_MS);
   let body;
   try {
-    const response = await fetchImpl(url2);
+    const response = await fetchImpl(url2, { signal: bound.signal });
     if (!response.ok) {
       throw new PublisherError("UNAVAILABLE", `could not ask ${portal} where to publish (it answered ${response.status})`, { retryable: true });
     }
     body = await response.json();
   } catch (e) {
-    if (PublisherError.isPublisherError(e)) throw e;
+    if (PublisherError.isPublisherError(e)) {
+      throw e;
+    }
     throw new PublisherError("NETWORK", `could not reach ${portal}: ${e instanceof Error ? e.message : String(e)}`, { retryable: true });
+  } finally {
+    clearTimeout(timer);
   }
   const endpoint = body?.publishingEndpoint;
   if (endpoint === null || endpoint === void 0) {
@@ -6305,7 +7030,9 @@ function suggestProfileName(endpoint, taken) {
 }
 function resolveChoice(answer, names) {
   const a = answer.trim();
-  if (!a) return null;
+  if (!a) {
+    return null;
+  }
   if (/^\d+$/.test(a)) {
     const i = Number(a);
     return i >= 1 && i <= names.length ? names[i - 1] : null;
@@ -6332,9 +7059,13 @@ ${purpose}
   for (let attempt = 0; attempt < 3; attempt++) {
     const answer = await ask3(`
 Which one? [1-${names.length}, or a name] `);
-    if (answer === null) return null;
+    if (answer === null) {
+      return null;
+    }
     const chosen = resolveChoice(answer, names);
-    if (chosen) return chosen;
+    if (chosen) {
+      return chosen;
+    }
     process.stderr.write(`Not one of those.
 `);
   }
@@ -6349,9 +7080,13 @@ Name this connection, so you never have to type ${endpoint} again.
     const answer = await ask3(suggested ? `
 Profile name [${suggested}]: ` : `
 Profile name: `);
-    if (answer === null) return null;
+    if (answer === null) {
+      return null;
+    }
     const name = answer.trim() || suggested;
-    if (name && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name)) return name;
+    if (name && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name)) {
+      return name;
+    }
     process.stderr.write(`Use letters, digits, dot, dash or underscore.
 `);
   }
@@ -6439,16 +7174,22 @@ Waiting (it expires in ${Math.round(expiresInSeconds / 60)} minutes)...
   );
 }
 async function login(ctx) {
-  if (ctx.flags["continue"] === true) return continueLogin(ctx);
+  if (ctx.flags["continue"] === true) {
+    return continueLogin(ctx);
+  }
   const clock = stopwatch();
   const target = resolveLoginEndpoint(ctx.input);
   const endpoint = "endpoint" in target ? target.endpoint : await discoverEndpoint(portalBase(process.env, str2(ctx.flags["portal"])));
-  if (!endpoint) throw new PublisherError("INVALID_REQUEST", "login requires --endpoint (or --profile naming a stored one)");
+  if (!endpoint) {
+    throw new PublisherError("INVALID_REQUEST", "login requires --endpoint (or --profile naming a stored one)");
+  }
   clock.lap("discovery");
   const profile = str2(ctx.flags["profile"]);
   const setDefault = ctx.flags["set-default"] === true;
   const given = str2(ctx.flags["token"]) ?? process.env["GIT_PUBLISHER_TOKEN"];
-  if (given) return finish(ctx, { endpoint, token: given, signIn: null, profile, setDefault }, clock);
+  if (given) {
+    return finish(ctx, { endpoint, token: given, signIn: null, profile, setDefault }, clock);
+  }
   if (ctx.flags["no-wait"] === true) {
     const started = await startDeviceLogin({ endpoint });
     clock.lap("start");
@@ -6481,7 +7222,9 @@ async function continueLogin(ctx) {
   try {
     signIn = await pollDeviceLogin(pending.started, { lastPolledAt: null, ...timeout === void 0 ? {} : { until: Date.now() + followTimeoutMs(timeout) } });
   } catch (e) {
-    if (e instanceof PublisherError && (e.code === "EXPIRED" || e.code === "FORBIDDEN")) await removePendingLogin();
+    if (e instanceof PublisherError && (e.code === "EXPIRED" || e.code === "FORBIDDEN")) {
+      await removePendingLogin();
+    }
     throw e;
   }
   clock.lap("approval");
@@ -6586,7 +7329,9 @@ async function installSkills({ log }) {
         'Claude Code is not installed, or "claude" is not on PATH. Install it from https://claude.com/claude-code, then run: publisher skills install'
       );
     }
-    if (r.code !== 0) throw new PublisherError("LOCAL_STATE", `"claude ${args.slice(0, 3).join(" ")}" failed: ${(r.stderr || r.stdout).trim()}`);
+    if (r.code !== 0) {
+      throw new PublisherError("LOCAL_STATE", `"claude ${args.slice(0, 3).join(" ")}" failed: ${(r.stderr || r.stdout).trim()}`);
+    }
   };
   await step("Adding the publisher to Claude Code\u2026", ["plugin", "marketplace", "add", source, "--scope", "user"]);
   await step("Installing its skills\u2026", ["plugin", "install", `${PLUGIN}@${MARKETPLACE}`, "--scope", "user"]);
@@ -6603,16 +7348,24 @@ async function installSkills({ log }) {
 // src/question.ts
 async function questionAt(p, endpoint, repoId, opts = {}) {
   const at = await portalAt(endpoint, opts);
-  if ("reason" in at) return at;
+  if ("reason" in at) {
+    return at;
+  }
   return shown(at.portal, await p.readPreparation({ portal: at.portal, repoId }));
 }
 async function answerAt(p, endpoint, repoId, specs, opts = {}) {
   const answers = parseSpecs(specs);
   const at = await portalAt(endpoint, opts);
-  if ("reason" in at) return at;
+  if ("reason" in at) {
+    return at;
+  }
   const read2 = shown(at.portal, await p.readPreparation({ portal: at.portal, repoId }));
-  if (read2.kind !== "view") return read2;
-  if (read2.questions.length === 0) throw new PublisherError("LOCAL_STATE", `nothing is waiting for an answer (the preparation is ${read2.preparation.status})`);
+  if (read2.kind !== "view") {
+    return read2;
+  }
+  if (read2.questions.length === 0) {
+    throw new PublisherError("LOCAL_STATE", `nothing is waiting for an answer (the preparation is ${read2.preparation.status})`);
+  }
   for (const [id, value] of Object.entries(answers)) {
     const question = read2.questions.find((q) => q.id === id);
     if (question === void 0) {
@@ -6628,11 +7381,15 @@ async function answerAt(p, endpoint, repoId, specs, opts = {}) {
   return shown(at.portal, await p.answerPreparation({ portal: at.portal, repoId, id: read2.preparation.id, revision: read2.preparation.revision, answers }));
 }
 function parseSpecs(specs) {
-  if (specs.length === 0) throw new PublisherError("INVALID_REQUEST", "answer takes one or more question=value");
+  if (specs.length === 0) {
+    throw new PublisherError("INVALID_REQUEST", "answer takes one or more question=value");
+  }
   const answers = {};
   for (const spec of specs) {
     const at = spec.indexOf("=");
-    if (at <= 0 || at === spec.length - 1) throw new PublisherError("INVALID_REQUEST", `"${spec}" is not question=value`);
+    if (at <= 0 || at === spec.length - 1) {
+      throw new PublisherError("INVALID_REQUEST", `"${spec}" is not question=value`);
+    }
     answers[spec.slice(0, at)] = spec.slice(at + 1);
   }
   return answers;
@@ -6640,7 +7397,9 @@ function parseSpecs(specs) {
 async function portalAt(endpoint, opts) {
   const derived = portalForEndpoint(endpoint);
   const confirmed = derived === null ? null : await confirmPortal(derived, endpoint, opts.fetch);
-  if (derived === null || confirmed === null) return { kind: "unavailable", reason: "no-portal", portal: null, hint: "Answer it in the portal." };
+  if (derived === null || confirmed === null) {
+    return { kind: "unavailable", reason: "no-portal", portal: null, hint: "Answer it in the portal." };
+  }
   if (!confirmed.terminal.includes(PREPARATION)) {
     return { kind: "unavailable", reason: "no-route", portal: derived, hint: `This portal cannot show the question in the terminal yet. Answer it in the portal: ${derived}.` };
   }
@@ -6667,7 +7426,9 @@ function shown(portal, r) {
   }
 }
 function hintFor(view) {
-  if (view.questions.length === 0) return "Nothing is waiting for an answer.";
+  if (view.questions.length === 0) {
+    return "Nothing is waiting for an answer.";
+  }
   const how = view.questions.map((q) => `${q.id}=<${q.options.map((o) => o.value).join("|")}>`).join(" ");
   return `It is waiting for your answer. Run: publisher answer ${how}`;
 }
@@ -6679,7 +7440,9 @@ var import_node_os4 = require("node:os");
 var FALLBACK_TEMP_DIRS = ["/tmp", "/var/tmp"];
 async function unusable(path) {
   try {
-    if (!(await (0, import_promises12.stat)(path)).isDirectory()) return "is not a directory";
+    if (!(await (0, import_promises12.stat)(path)).isDirectory()) {
+      return "is not a directory";
+    }
   } catch {
     return "does not exist";
   }
@@ -6693,7 +7456,9 @@ async function unusable(path) {
 async function ensureTempDir(env = process.env, fallbacks = FALLBACK_TEMP_DIRS) {
   const named = (0, import_node_os4.tmpdir)();
   const reason = await unusable(named);
-  if (reason === null) return { path: named, replaced: null };
+  if (reason === null) {
+    return { path: named, replaced: null };
+  }
   for (const candidate of fallbacks) {
     if (candidate !== named && await unusable(candidate) === null) {
       env["TMPDIR"] = candidate;
@@ -6833,19 +7598,27 @@ async function main(argv) {
   const quiet = flags["quiet"] === true || json;
   const out = (v) => process.stdout.write((json ? JSON.stringify(v) : formatHuman(v)) + "\n");
   const log = (s) => {
-    if (!quiet) process.stderr.write(s + "\n");
+    if (!quiet) {
+      process.stderr.write(s + "\n");
+    }
   };
   const progress = (e) => {
-    if (quiet) return;
+    if (quiet) {
+      return;
+    }
     const pct = e.total ? ` ${Math.round((e.bytes ?? 0) / e.total * 100)}%` : "";
     process.stderr.write(`\r[${e.phase}] ${e.message}${pct}          `);
-    if (e.phase === "done") process.stderr.write("\n");
+    if (e.phase === "done") {
+      process.stderr.write("\n");
+    }
   };
   const dirArg = (i) => (0, import_node_path9.resolve)(cmd[i] ?? ".");
   const following = { ...stageEmitter(json, quiet), log, untilChange: flags["until-change"] === true };
   const resolutionInput = async (dir) => {
     let association;
-    if (dir && await isGitRepo(dir)) association = (await readAssociation(dir))?.endpoint;
+    if (dir && await isGitRepo(dir)) {
+      association = (await readAssociation(dir))?.endpoint;
+    }
     return {
       ...optStr(flags, "endpoint"),
       ...optStr(flags, "profile"),
@@ -6907,7 +7680,9 @@ async function main(argv) {
   }
   if (flags["help"] !== true && GIT_COMMANDS.has(cmd[0] ?? "")) {
     const line = replacedLine(await ensureTempDir());
-    if (line !== null) process.stderr.write(line + "\n");
+    if (line !== null) {
+      process.stderr.write(line + "\n");
+    }
   }
   switch (flags["help"] === true ? "help" : cmd[0]) {
     case void 0:
@@ -6962,7 +7737,9 @@ async function main(argv) {
     case "logout": {
       const profile = str2(flags["profile"]);
       const endpoint = str2(flags["endpoint"]) ?? process.env["GIT_PUBLISHER_ENDPOINT"];
-      if (!profile && !endpoint) throw new PublisherError("INVALID_REQUEST", "logout requires --endpoint or --profile");
+      if (!profile && !endpoint) {
+        throw new PublisherError("INVALID_REQUEST", "logout requires --endpoint or --profile");
+      }
       const { revoked } = profile ? await removeProfile(profile, { revoke: true }) : await removeCredential(endpoint, { revoke: true });
       out({ ok: true, ...profile ? { profile } : { endpoint }, revoked });
       return 0;
@@ -6980,14 +7757,18 @@ async function main(argv) {
           return 0;
         case "use": {
           const name = cmd[2];
-          if (!name) throw new PublisherError("INVALID_REQUEST", "profile use requires a name");
+          if (!name) {
+            throw new PublisherError("INVALID_REQUEST", "profile use requires a name");
+          }
           await setDefaultProfile(name);
           out({ ok: true, defaultProfile: name, endpoint: file.profiles[name].endpoint });
           return 0;
         }
         case "remove": {
           const name = cmd[2];
-          if (!name) throw new PublisherError("INVALID_REQUEST", "profile remove requires a name");
+          if (!name) {
+            throw new PublisherError("INVALID_REQUEST", "profile remove requires a name");
+          }
           await removeProfile(name);
           out({ ok: true, removed: name });
           return 0;
@@ -7026,7 +7807,9 @@ async function main(argv) {
       const updates = refs.length ? refs.map((r) => ({ ref: r.startsWith("refs/") ? r : `refs/heads/${r}`, force })) : void 0;
       if (!updates && force) {
         const b = await currentBranch(dir);
-        if (!b) throw new PublisherError("LOCAL_STATE", "detached HEAD");
+        if (!b) {
+          throw new PublisherError("LOCAL_STATE", "detached HEAD");
+        }
         return finishPublish2(await p.publish({ repoDir: dir, updates: [{ ref: b, force: true }], wait: flags["no-wait"] !== true }, { onProgress: progress }));
       }
       return finishPublish2(await p.publish({ repoDir: dir, ...updates ? { updates } : {}, wait: flags["no-wait"] !== true }, { onProgress: progress }));
@@ -7038,7 +7821,9 @@ async function main(argv) {
       if (pubId) {
         const a = await readAssociation(dir);
         const repoId = str2(flags["repo"]) ?? a?.repoId;
-        if (!repoId) throw new PublisherError("LOCAL_STATE", "no repository association; pass --repo");
+        if (!repoId) {
+          throw new PublisherError("LOCAL_STATE", "no repository association; pass --repo");
+        }
         const s = await p.getPublicationStatus(repoId, pubId);
         out(s);
         return s.state === "accepted" ? 0 : s.state === "rejected" ? 2 : 3;
@@ -7074,7 +7859,9 @@ async function main(argv) {
     case "checkout": {
       const dir = dirArg(1);
       const repoId = str2(flags["repo"]);
-      if (!repoId) throw new PublisherError("INVALID_REQUEST", "checkout requires --repo <id>");
+      if (!repoId) {
+        throw new PublisherError("INVALID_REQUEST", "checkout requires --repo <id>");
+      }
       const { p } = await client();
       const branch = str2(flags["branch"]);
       const m = await p.checkout({ directory: dir, repoId, ...branch ? { branch } : {} }, { onProgress: progress });
@@ -7140,11 +7927,15 @@ async function main(argv) {
     case "follow": {
       const dir = dirArg(1);
       const publicationId = str2(flags["publication"]);
-      if (!publicationId) throw new PublisherError("INVALID_REQUEST", "follow requires --publication <id>");
+      if (!publicationId) {
+        throw new PublisherError("INVALID_REQUEST", "follow requires --publication <id>");
+      }
       const timeoutMs = followTimeoutMs(str2(flags["timeout"]));
       const { p, endpoint } = await client(dir);
       const repoId = str2(flags["repo"]) ?? (await readAssociation(dir))?.repoId;
-      if (!repoId) throw new PublisherError("LOCAL_STATE", "no repository association; pass --repo");
+      if (!repoId) {
+        throw new PublisherError("LOCAL_STATE", "no repository association; pass --repo");
+      }
       const publication = await p.getPublicationStatus(repoId, publicationId);
       if (publication.state !== "accepted") {
         throw new PublisherError("LOCAL_STATE", `publication ${publicationId} is ${publication.state}, not accepted; run publisher status`);
@@ -7164,7 +7955,9 @@ async function main(argv) {
       const dir = dirArg(1);
       const { p, endpoint } = await client(dir);
       const repoId = str2(flags["repo"]) ?? (await readAssociation(dir))?.repoId;
-      if (!repoId) throw new PublisherError("LOCAL_STATE", "no repository association; pass --repo");
+      if (!repoId) {
+        throw new PublisherError("LOCAL_STATE", "no repository association; pass --repo");
+      }
       out({ repoId, ...await questionAt(p, endpoint, repoId) });
       return 0;
     }
@@ -7173,12 +7966,16 @@ async function main(argv) {
       const dir = (0, import_node_path9.resolve)(".");
       const { p, endpoint } = await client(dir);
       const repoId = str2(flags["repo"]) ?? (await readAssociation(dir))?.repoId;
-      if (!repoId) throw new PublisherError("LOCAL_STATE", "no repository association; pass --repo");
+      if (!repoId) {
+        throw new PublisherError("LOCAL_STATE", "no repository association; pass --repo");
+      }
       out({ repoId, ...await answerAt(p, endpoint, repoId, cmd.slice(1)) });
       return 0;
     }
     case "skills": {
-      if (cmd[1] !== "install") throw new PublisherError("INVALID_REQUEST", `unknown skills command: ${cmd[1] ?? "(none)"}; expected install`);
+      if (cmd[1] !== "install") {
+        throw new PublisherError("INVALID_REQUEST", `unknown skills command: ${cmd[1] ?? "(none)"}; expected install`);
+      }
       const r = await installSkills({ log });
       out(r);
       return 0;
@@ -7187,7 +7984,9 @@ async function main(argv) {
       const dir = dirArg(1);
       const ours = str2(flags["ours"]);
       const theirs = str2(flags["theirs"]);
-      if (!ours || !theirs) throw new PublisherError("INVALID_REQUEST", "merge-check requires --ours and --theirs");
+      if (!ours || !theirs) {
+        throw new PublisherError("INVALID_REQUEST", "merge-check requires --ours and --theirs");
+      }
       const r = await mergeRemote({
         repoDir: dir,
         ours: ours.startsWith("refs/") ? ours : `refs/heads/${ours}`,
@@ -7203,7 +8002,9 @@ async function main(argv) {
       const { p } = await client(dir);
       const a = await readAssociation(dir);
       const repoId = str2(flags["repo"]) ?? a?.repoId;
-      if (!repoId) throw new PublisherError("LOCAL_STATE", "no repository association; pass --repo");
+      if (!repoId) {
+        throw new PublisherError("LOCAL_STATE", "no repository association; pass --repo");
+      }
       out(await p.getRepository(repoId));
       return 0;
     }
@@ -7215,7 +8016,9 @@ ${USAGE}`);
 }
 var GIT_COMMANDS = /* @__PURE__ */ new Set(["init", "publish", "status", "fetch", "checkout", "workspace-status", "sync", "merge-check"]);
 async function demand(r, input) {
-  if (r.kind === "resolved") return r;
+  if (r.kind === "resolved") {
+    return r;
+  }
   const next = nextStep(credentialStatus(input));
   const details = { profiles: r.kind === "none" ? [] : r.profiles, next };
   const run = next.command === null ? "" : ` Run: ${next.command}`;