@minnovate/shadow-publisher 0.11.8 → 0.11.10

package/dist/publisher.cjs

@@ -27,9 +27,6 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// src/main.ts
-var import_node_path9 = require("node:path");
-
 // ../protocol/src/versions.ts
 var PROTOCOL_VERSION = 1;
 var PROTOCOL_HEADER = "x-publisher-protocol";
@@ -656,7 +653,7 @@ function $constructor(name, initializer2, proto, params) {
   Internals.prototype = zodProto;
   const protoMembers = proto;
   const initialized = protoMembers && /* @__PURE__ */ new WeakSet();
-  function init(inst, def) {
+  function init2(inst, def) {
     if (!inst._zod) {
       _zodDesc.value = new Internals(def);
       try {
@@ -696,7 +693,7 @@ function $constructor(name, initializer2, proto, params) {
   Object.defineProperty(Definition, "name", { value: name });
   function _(def) {
     const inst = params?.Parent ? newError(Definition) : this;
-    init(inst, def);
+    init2(inst, def);
     const deferred = inst._zod.deferred;
     if (deferred) {
       for (const fn of deferred) {
@@ -709,7 +706,7 @@ function $constructor(name, initializer2, proto, params) {
       pp(inst);
     return inst;
   }
-  Object.defineProperty(_, "init", { value: init });
+  Object.defineProperty(_, "init", { value: init2 });
   Object.defineProperty(_, Symbol.hasInstance, {
     value: (inst) => {
       if (params?.Parent && inst instanceof params.Parent)
@@ -3071,6 +3068,10 @@ function sanitizedGitEnv(opts = {}) {
     TZ: "UTC",
     GIT_CONFIG_NOSYSTEM: "1",
     GIT_CONFIG_GLOBAL: "/dev/null",
+    // The defaults of core.excludesFile and core.attributesFile are `$XDG_CONFIG_HOME/git/…`, read
+    // even with no global config file, and HOME is often `/tmp`, which every local user can write.
+    // A directory that cannot exist, so git finds neither (it ignores ENOTDIR without a warning).
+    XDG_CONFIG_HOME: "/dev/null",
     GIT_TERMINAL_PROMPT: "0",
     GIT_OPTIONAL_LOCKS: "0",
     GIT_ATTR_NOSYSTEM: "1",
@@ -3231,8 +3232,8 @@ function closeOrIgnored(child) {
   if (lc.ignored) {
     return Promise.resolve(false);
   }
-  return new Promise((resolve3) => {
-    lc.waiters.add(() => resolve3(childClosed(child)));
+  return new Promise((resolve4) => {
+    lc.waiters.add(() => resolve4(childClosed(child)));
   });
 }
 async function endedOrIgnored(child) {
@@ -3277,7 +3278,7 @@ function waitWithin(start, ms, stop) {
     return Promise.resolve({ status: "stopped" });
   }
   const ac = new AbortController();
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let timer = null;
     let done = false;
     const onStop = () => settle({ status: "stopped" });
@@ -3293,7 +3294,7 @@ function waitWithin(start, ms, stop) {
       if (r.status !== "value" && r.status !== "error") {
         ac.abort();
       }
-      resolve3(r);
+      resolve4(r);
     };
     let p;
     try {
@@ -3332,24 +3333,24 @@ function spawnTracked(args, opts) {
 }
 function feedStdin(child, input, onSourceError) {
   let unpipe = () => void 0;
-  const done = new Promise((resolve3) => {
-    child.stdin.on("error", () => resolve3());
+  const done = new Promise((resolve4) => {
+    child.stdin.on("error", () => resolve4());
     if (input === void 0) {
       child.stdin.end();
-      resolve3();
+      resolve4();
     } else if (typeof input === "string" || Buffer.isBuffer(input)) {
-      child.stdin.end(input, () => resolve3());
+      child.stdin.end(input, () => resolve4());
     } else {
       input.on("error", () => {
         onSourceError();
-        resolve3();
+        resolve4();
       });
       input.pipe(child.stdin);
       unpipe = () => {
         input.unpipe(child.stdin);
-        resolve3();
+        resolve4();
       };
-      child.stdin.on("finish", () => resolve3());
+      child.stdin.on("finish", () => resolve4());
       child.on("close", unpipe);
     }
   });
@@ -3462,11 +3463,11 @@ function startWatchdog(child, opts, kill, isClosed) {
   const pgid = child.pid;
   let stopped = false;
   const stopper = new AbortController();
-  const sleep2 = (ms) => new Promise((resolve3) => {
+  const sleep2 = (ms) => new Promise((resolve4) => {
     const wake = () => {
       clearTimeout(t);
       stopper.signal.removeEventListener("abort", wake);
-      resolve3();
+      resolve4();
     };
     const t = setTimeout(wake, ms);
     t.unref();
@@ -3544,8 +3545,8 @@ async function scanProcessGroup(pgid, signal) {
         if (Number(rest[2]) !== pgid) {
           continue;
         }
-        const status = await (0, import_promises.readFile)(`/proc/${name}/status`, "utf8");
-        members2.push({ pid: Number(name), rss: Number(/^VmRSS:\s+(\d+)/m.exec(status)?.[1] ?? 0) * 1024 });
+        const status2 = await (0, import_promises.readFile)(`/proc/${name}/status`, "utf8");
+        members2.push({ pid: Number(name), rss: Number(/^VmRSS:\s+(\d+)/m.exec(status2)?.[1] ?? 0) * 1024 });
       } catch (e) {
         const code = e.code;
         if (code === "ENOENT" || code === "ESRCH") {
@@ -3723,7 +3724,7 @@ async function reapChild(child, opts = {}) {
       if (groupCleared || !childClosed(child) || Date.now() >= deadline) {
         break;
       }
-      await new Promise((resolve3) => setTimeout(resolve3, Math.min(25, deadline - Date.now())));
+      await new Promise((resolve4) => setTimeout(resolve4, Math.min(25, deadline - Date.now())));
     }
     if (groupCleared === false) {
       timedOut = true;
@@ -3731,12 +3732,12 @@ async function reapChild(child, opts = {}) {
   }
   return { closed: childClosed(child), groupCleared, timedOut, survivors };
 }
-function reapSucceeded(outcome) {
-  return outcome.closed && outcome.groupCleared === true;
+function reapSucceeded(outcome2) {
+  return outcome2.closed && outcome2.groupCleared === true;
 }
-function cleanupFailure(what, outcome, cause) {
-  const why = !outcome.closed ? "the process did not close within the cleanup bound" : outcome.groupCleared === null ? "its process group could not be observed" : `its process group still has ${outcome.survivors.length} member(s)`;
-  const cleanup = { closed: outcome.closed, groupCleared: outcome.groupCleared, timedOut: outcome.timedOut, survivors: outcome.survivors };
+function cleanupFailure(what, outcome2, cause) {
+  const why = !outcome2.closed ? "the process did not close within the cleanup bound" : outcome2.groupCleared === null ? "its process group could not be observed" : `its process group still has ${outcome2.survivors.length} member(s)`;
+  const cleanup = { closed: outcome2.closed, groupCleared: outcome2.groupCleared, timedOut: outcome2.timedOut, survivors: outcome2.survivors };
   if (typeof cause === "string") {
     cleanup["preempted"] = cause;
   }
@@ -3778,12 +3779,12 @@ var import_promises2 = require("node:fs/promises");
 async function sha256File(path) {
   const h = (0, import_node_crypto2.createHash)("sha256");
   let size = 0;
-  await new Promise((resolve3, reject) => {
+  await new Promise((resolve4, reject) => {
     (0, import_node_fs2.createReadStream)(path).on("data", (c) => {
       const b = typeof c === "string" ? Buffer.from(c) : c;
       size += b.length;
       h.update(b);
-    }).on("error", reject).on("end", () => resolve3());
+    }).on("error", reject).on("end", () => resolve4());
   });
   const st = await (0, import_promises2.stat)(path);
   if (st.size !== size) {
@@ -3909,7 +3910,7 @@ async function packObjectsToFile(repoDir, extraArgs, stdinLines, opts) {
   opts.signal?.addEventListener("abort", onAbort, { once: true });
   let failure2 = null;
   try {
-    const finished = new Promise((resolve3, reject) => out.on("finish", () => resolve3()).on("error", reject));
+    const finished = new Promise((resolve4, reject) => out.on("finish", () => resolve4()).on("error", reject));
     finished.catch(() => void 0);
     child.stdout.pipe(out);
     child.stdin.on("error", () => void 0);
@@ -3958,8 +3959,8 @@ async function packObjectsToFile(repoDir, extraArgs, stdinLines, opts) {
 }
 function delay(ms) {
   let t;
-  const p = new Promise((resolve3) => {
-    t = setTimeout(resolve3, ms);
+  const p = new Promise((resolve4) => {
+    t = setTimeout(resolve4, ms);
     t.unref();
   });
   p.cancel = () => clearTimeout(t);
@@ -4353,19 +4354,19 @@ async function advanceWorkspaceBase(directory, next, now = /* @__PURE__ */ new D
   await setConfig(m.directory, `${NS}.baseadvancedat`, updated.baseAdvancedAt);
   return updated;
 }
-async function noteAcceptedPublication(directory, outcome, now = /* @__PURE__ */ new Date()) {
-  if (outcome.state !== "accepted" || outcome.resultGeneration === null) {
+async function noteAcceptedPublication(directory, outcome2, now = /* @__PURE__ */ new Date()) {
+  if (outcome2.state !== "accepted" || outcome2.resultGeneration === null) {
     return;
   }
   const m = await getWorkspaceMapping(directory).catch(() => null);
-  if (!m || m.repoId !== outcome.repoId) {
+  if (!m || m.repoId !== outcome2.repoId) {
     return;
   }
-  const oid = outcome.refs?.[`refs/heads/${m.branch}`];
+  const oid = outcome2.refs?.[`refs/heads/${m.branch}`];
   if (!oid) {
     return;
   }
-  await advanceWorkspaceBase(directory, { oid, generation: outcome.resultGeneration }, now);
+  await advanceWorkspaceBase(directory, { oid, generation: outcome2.resultGeneration }, now);
 }
 async function adoptWorkspace(client, directory, call2 = {}, now = /* @__PURE__ */ new Date()) {
   const dir = (0, import_node_path3.resolve)(directory);
@@ -4922,13 +4923,13 @@ function credentialStatus(input) {
   const credentials = resolution.kind === "ambiguous" ? "ambiguous" : resolution.kind === "resolved" ? env["GIT_PUBLISHER_TOKEN"] && !endpointStated(resolution.source) ? "unbound" : env["GIT_PUBLISHER_TOKEN"] || file.endpoints[resolution.endpoint] ? "ok" : "missing" : profiles.length === 0 ? "none" : "missing";
   return { profiles, defaultProfile: file.defaultProfile ?? null, resolution, credentials };
 }
-function nextStep(status) {
-  const profiles = status.profiles.map((p) => p.name);
-  const r = status.resolution;
-  if (status.credentials === "ok") {
+function nextStep(status2) {
+  const profiles = status2.profiles.map((p) => p.name);
+  const r = status2.resolution;
+  if (status2.credentials === "ok") {
     return { action: "ready", ask: null, command: null, profiles };
   }
-  if (status.credentials === "unbound") {
+  if (status2.credentials === "unbound") {
     return { action: "bind-endpoint", ask: null, command: null, profiles };
   }
   if (r.kind === "ambiguous" || r.kind === "unknown-profile") {
@@ -5075,33 +5076,33 @@ async function createApplication(input, opts) {
   let refreshed = false;
   let lastOutage = "";
   for (let attempt = 0; attempt < ATTEMPTS; ) {
-    const answer = await post(fetchImpl, url2, await opts.token(), body);
-    if (answer.status === 401 && !refreshed && opts.refresh !== void 0) {
+    const answer2 = await post(fetchImpl, url2, await opts.token(), body);
+    if (answer2.status === 401 && !refreshed && opts.refresh !== void 0) {
       refreshed = true;
       if (await opts.refresh()) {
         continue;
       }
     }
-    if (answer.status === 200 || answer.status === 201) {
-      return read(answer.body, answer.status === 201);
+    if (answer2.status === 200 || answer2.status === 201) {
+      return read(answer2.body, answer2.status === 201);
     }
-    const code = portalRefusalCode(answer.body) ?? "";
-    if (answer.status === 401) {
+    const code = portalRefusalCode(answer2.body) ?? "";
+    if (answer2.status === 401) {
       throw new PublisherError("UNAUTHORIZED", 'the portal did not accept this credential; run "publisher login" again');
     }
-    if (answer.status === 403) {
+    if (answer2.status === 403) {
       throw new PublisherError("FORBIDDEN", `the portal refused to make an application here (${code || "forbidden"})`);
     }
-    if (answer.status === 409 && REFUSALS[code] !== void 0) {
+    if (answer2.status === 409 && REFUSALS[code] !== void 0) {
       throw new PublisherError(REFUSALS[code], `the portal refused the repository (${code})`, { details: { portal: code } });
     }
-    if (answer.status === 400 || answer.status === 409) {
-      throw new PublisherError("INVALID_REQUEST", `the portal refused the request (${code || answer.status})`, { details: { portal: code } });
+    if (answer2.status === 400 || answer2.status === 409) {
+      throw new PublisherError("INVALID_REQUEST", `the portal refused the request (${code || answer2.status})`, { details: { portal: code } });
     }
-    lastOutage = answer.status === 0 ? "the portal could not be reached" : `the portal answered ${answer.status}`;
+    lastOutage = answer2.status === 0 ? "the portal could not be reached" : `the portal answered ${answer2.status}`;
     attempt += 1;
     if (attempt < ATTEMPTS) {
-      await new Promise((resolve3) => setTimeout(resolve3, (opts.retryDelayMs ?? 1e3) * attempt));
+      await new Promise((resolve4) => setTimeout(resolve4, (opts.retryDelayMs ?? 1e3) * attempt));
     }
   }
   throw new PublisherError("UNAVAILABLE", `could not make the application: ${lastOutage}; run init again`, { retryable: true });
@@ -5237,21 +5238,21 @@ var Transport = class {
     }
   }
 };
-function fallbackCode(status) {
-  if (status === 401) {
+function fallbackCode(status2) {
+  if (status2 === 401) {
     return "UNAUTHORIZED";
   }
-  if (status === 403) {
+  if (status2 === 403) {
     return "FORBIDDEN";
   }
-  if (status === 429) {
+  if (status2 === 429) {
     return "UNAVAILABLE";
   }
-  return status >= 500 ? "UNAVAILABLE" : "INVALID_REQUEST";
+  return status2 >= 500 ? "UNAVAILABLE" : "INVALID_REQUEST";
 }
 function sleep(ms, signal) {
-  return new Promise((resolve3, reject) => {
-    const t = setTimeout(resolve3, ms);
+  return new Promise((resolve4, reject) => {
+    const t = setTimeout(resolve4, ms);
     signal?.addEventListener(
       "abort",
       () => {
@@ -5327,24 +5328,24 @@ async function followRun(input, opts) {
   let refreshed = false;
   let answered = false;
   for (; ; ) {
-    const answer = await ask(fetchImpl, url2, await opts.token());
-    if (answer.status === 401 && !refreshed && opts.refresh !== void 0) {
+    const answer2 = await ask(fetchImpl, url2, await opts.token());
+    if (answer2.status === 401 && !refreshed && opts.refresh !== void 0) {
       refreshed = true;
       if (await opts.refresh()) {
         continue;
       }
     }
-    if (answer.status === 401) {
+    if (answer2.status === 401) {
       return { kind: "unauthorized" };
     }
-    if (answer.status === 404) {
+    if (answer2.status === 404) {
       return { kind: "unavailable", reason: "no-route" };
     }
-    if (answer.status === 403) {
+    if (answer2.status === 403) {
       return { kind: "forbidden" };
     }
-    if (answer.status === 200) {
-      const run = soleRun(answer.body);
+    if (answer2.status === 200) {
+      const run = soleRun(answer2.body);
       if ("detail" in run) {
         return { kind: "malformed", detail: run.detail };
       }
@@ -5381,7 +5382,7 @@ async function followRun(input, opts) {
       answered = true;
       lastError = null;
     } else {
-      lastError = answer.status === 0 ? "the portal could not be reached" : `the portal answered ${answer.status}`;
+      lastError = answer2.status === 0 ? "the portal could not be reached" : `the portal answered ${answer2.status}`;
     }
     if (now() + interval2 > deadline) {
       return { kind: "timed-out", stages: last, lastError };
@@ -5467,44 +5468,44 @@ async function call(input, opts, body) {
   const url2 = `${input.portal.replace(/\/+$/, "")}/api/v1/terminal/repositories/${encodeURIComponent(input.repoId)}/preparation`;
   let refreshed = false;
   for (; ; ) {
-    const answer = await ask2(fetchImpl, url2, await opts.token(), body);
-    if (answer.status === 401 && !refreshed && opts.refresh !== void 0) {
+    const answer2 = await ask2(fetchImpl, url2, await opts.token(), body);
+    if (answer2.status === 401 && !refreshed && opts.refresh !== void 0) {
       refreshed = true;
       if (await opts.refresh()) {
         continue;
       }
     }
-    if (answer.status === 401) {
+    if (answer2.status === 401) {
       return { kind: "unauthorized" };
     }
-    if (answer.status === 403) {
+    if (answer2.status === 403) {
       return { kind: "forbidden" };
     }
-    if (answer.status === 409) {
+    if (answer2.status === 409) {
       return { kind: "moved-on" };
     }
-    if (answer.status === 404) {
-      return portalRefusalCode(answer.body) === "no-such-application" ? { kind: "no-application" } : { kind: "unavailable", detail: "the portal does not serve this address" };
+    if (answer2.status === 404) {
+      return portalRefusalCode(answer2.body) === "no-such-application" ? { kind: "no-application" } : { kind: "unavailable", detail: "the portal does not serve this address" };
     }
-    if (answer.status === 200) {
-      const view = readView(answer.body);
+    if (answer2.status === 200) {
+      const view = readView(answer2.body);
       return "detail" in view ? { kind: "malformed", detail: view.detail } : { kind: "view", view };
     }
-    return { kind: "unavailable", detail: answer.status === 0 ? "the portal could not be reached" : `the portal answered ${answer.status}` };
+    return { kind: "unavailable", detail: answer2.status === 0 ? "the portal could not be reached" : `the portal answered ${answer2.status}` };
   }
 }
 function readView(body) {
   if (!isRecord4(body)) {
     return { detail: "an answer that is not a preparation" };
   }
-  const { id, revision, status, message, questions, publication } = body;
+  const { id, revision, status: status2, message, questions, publication } = body;
   if (typeof id !== "string" || id === "") {
     return { detail: "a preparation with no id" };
   }
   if (typeof revision !== "number" || !Number.isSafeInteger(revision) || revision < 1) {
     return { detail: "a preparation with no revision" };
   }
-  if (!STATUSES.includes(status)) {
+  if (!STATUSES.includes(status2)) {
     return { detail: "a preparation with an unknown status" };
   }
   if (typeof message !== "string") {
@@ -5531,7 +5532,7 @@ function readView(body) {
   if (isRecord4(publication) && typeof publication["status"] === "string" && typeof publication["message"] === "string") {
     pub = { status: publication["status"], message: publication["message"], ...typeof publication["url"] === "string" ? { url: publication["url"] } : {} };
   }
-  return { id, revision, status, message, questions: read2, publication: pub, findings: readFindings(body["findings"]) };
+  return { id, revision, status: status2, message, questions: read2, publication: pub, findings: readFindings(body["findings"]) };
 }
 function readFindings(value) {
   if (!Array.isArray(value)) {
@@ -5891,14 +5892,14 @@ async function publish(ctx, repoId, remote, opts, call2) {
       progress({ phase: "resolve", message: `resuming publication ${pending2.publicationId}` });
       return runPublication(ctx, repoId, remote, repoDir, store2, pending2, opts, call2, true);
     }
-    const outcome = await resolvePending(ctx, repoDir, remote, pending2, call2, store2);
-    if (outcome.state === "finalizing" || outcome.state === "unknown") {
+    const outcome2 = await resolvePending(ctx, repoDir, remote, pending2, call2, store2);
+    if (outcome2.state === "finalizing" || outcome2.state === "unknown") {
       throw new PublisherError("OUTCOME_UNKNOWN", `publication ${pending2.publicationId} is still being processed; run status before publishing again`, {
         retryable: true,
         details: { publicationId: pending2.publicationId }
       });
     }
-    if (outcome.state === "accepted") {
+    if (outcome2.state === "accepted") {
       const fresh = await ctx.getRepository(repoId, call2);
       let remaining = [];
       try {
@@ -5909,7 +5910,7 @@ async function publish(ctx, repoId, remote, opts, call2) {
         }
       }
       if (remaining.length === 0) {
-        return toOutcome(outcome, true, pending2.refUpdates);
+        return toOutcome(outcome2, true, pending2.refUpdates);
       }
       return publish(ctx, repoId, remote, opts, call2);
     }
@@ -5925,9 +5926,9 @@ async function publish(ctx, repoId, remote, opts, call2) {
   if (needsPack) {
     progress({ phase: "pack", message: "packing objects" });
     const exclude = [];
-    for (const info of await batchCheck(repoDir, remoteOids)) {
-      if (info.type !== "missing") {
-        exclude.push(info.oid);
+    for (const info2 of await batchCheck(repoDir, remoteOids)) {
+      if (info2.type !== "missing") {
+        exclude.push(info2.oid);
       }
     }
     const outPath = store2.packPath(publicationId);
@@ -6097,12 +6098,12 @@ function toOutcome(s, resumed, updates) {
   };
 }
 var REF_MOVED = /* @__PURE__ */ new Set(["NON_FAST_FORWARD", "EXPECTED_OLD_MISMATCH", "STALE_GENERATION"]);
-function publishNext(rejection, published) {
+function publishNext(rejection, published2) {
   if (rejection === null || !REF_MOVED.has(rejection.code)) {
     return null;
   }
   const named = rejection.details?.["ref"];
-  const ref = typeof named === "string" ? named : published;
+  const ref = typeof named === "string" ? named : published2;
   const name = ref?.replace(/^refs\/heads\//, "") ?? "main";
   return {
     action: "sync-and-publish",
@@ -6453,9 +6454,9 @@ var Publisher = class {
   /** Publish existing local commits. Never modifies the worktree; safe to retry and resume. */
   async publish(options, call2 = {}) {
     const { repoId, remote } = await this.resolveRepo(options.repoDir, options.repoId);
-    const outcome = await publish(this.publishContext(), repoId, remote, options, call2);
-    await noteAcceptedPublication(options.repoDir, outcome);
-    return outcome;
+    const outcome2 = await publish(this.publishContext(), repoId, remote, options, call2);
+    await noteAcceptedPublication(options.repoDir, outcome2);
+    return outcome2;
   }
   // ---- workspaces (docs/archive/workspace-parity.md) ------------------------------------------------
   /** Create a NEW editable workspace (clone + mapping) for a published repository. */
@@ -6513,8 +6514,8 @@ var Publisher = class {
     if (tip === null || tip === (reconciled.before.remote?.oid ?? null)) {
       return { ...base, state: "up_to_date", published: null, marked: false };
     }
-    const published = await this.publish({ repoDir: dir }, call2);
-    return { ...base, state: published.state === "accepted" ? "published" : published.state === "rejected" ? "rejected" : "unknown", published, marked: false };
+    const published2 = await this.publish({ repoDir: dir }, call2);
+    return { ...base, state: published2.state === "accepted" ? "published" : published2.state === "rejected" ? "rejected" : "unknown", published: published2, marked: false };
   }
   /** Resolve interrupted publications recorded locally without creating duplicates. */
   async resumePublications(repoDir, call2 = {}) {
@@ -6764,10 +6765,84 @@ async function removePendingLogin() {
   await (0, import_promises10.rm)(pendingLoginPath(), { force: true });
 }
 
-// src/git-minimum.ts
-var CLIENT_GIT_MINIMUM = "2.43.0";
-function gitSupported(version2) {
-  return compareVersions(version2, CLIENT_GIT_MINIMUM) >= 0;
+// src/args.ts
+var import_node_util2 = require("node:util");
+var OPTIONS = {
+  endpoint: { type: "string" },
+  profile: { type: "string" },
+  token: { type: "string" },
+  portal: { type: "string" },
+  name: { type: "string" },
+  repo: { type: "string" },
+  message: { type: "string" },
+  publication: { type: "string" },
+  timeout: { type: "string" },
+  branch: { type: "string" },
+  ours: { type: "string" },
+  theirs: { type: "string" },
+  to: { type: "string" },
+  cursor: { type: "string" },
+  ref: { type: "string", multiple: true },
+  json: { type: "boolean" },
+  quiet: { type: "boolean" },
+  force: { type: "boolean" },
+  apply: { type: "boolean" },
+  "mark-conflicts": { type: "boolean" },
+  help: { type: "boolean" },
+  version: { type: "boolean" },
+  "set-default": { type: "boolean" },
+  archived: { type: "boolean" },
+  // A flag of its own, not a negation of --wait: there is no --wait.
+  "no-wait": { type: "boolean" },
+  "until-change": { type: "boolean" },
+  // `login --continue`: finish the sign-in a `login --no-wait` started.
+  continue: { type: "boolean" }
+};
+function str2(v) {
+  return typeof v === "string" ? v : void 0;
+}
+function parseArgs(argv) {
+  try {
+    const { positionals, values } = (0, import_node_util2.parseArgs)({ args: argv, options: OPTIONS, allowPositionals: true, strict: true });
+    return { cmd: positionals, flags: { ...values } };
+  } catch (e) {
+    throw new PublisherError("INVALID_REQUEST", e instanceof Error ? e.message : String(e));
+  }
+}
+
+// src/discover.ts
+var DEFAULT_PORTAL_URL = "https://shadow.minnovate.ai";
+function portalBase(env, flag) {
+  return (flag ?? env["GIT_PUBLISHER_PORTAL"] ?? DEFAULT_PORTAL_URL).replace(/\/+$/, "");
+}
+var DISCOVER_TIMEOUT_MS = 1e4;
+async function discoverEndpoint(portal, fetchImpl = fetch) {
+  const url2 = `${portal}/api/v1/config`;
+  const bound = new AbortController();
+  const timer = setTimeout(() => bound.abort(new DOMException("the request timed out", "TimeoutError")), DISCOVER_TIMEOUT_MS);
+  let body;
+  try {
+    const response = await fetchImpl(url2, { signal: bound.signal });
+    if (!response.ok) {
+      throw new PublisherError("UNAVAILABLE", `could not ask ${portal} where to publish (it answered ${response.status})`, { retryable: true });
+    }
+    body = await response.json();
+  } catch (e) {
+    if (PublisherError.isPublisherError(e)) {
+      throw e;
+    }
+    throw new PublisherError("NETWORK", `could not reach ${portal}: ${e instanceof Error ? e.message : String(e)}`, { retryable: true });
+  } finally {
+    clearTimeout(timer);
+  }
+  const endpoint = body?.publishingEndpoint;
+  if (endpoint === null || endpoint === void 0) {
+    throw new PublisherError("LOCAL_STATE", `${portal} is not set up for publishing; ask whoever runs it, or pass --endpoint`);
+  }
+  if (typeof endpoint !== "string" || endpoint.trim() === "") {
+    throw new PublisherError("UNAVAILABLE", `${portal} answered with something this version does not understand`, { retryable: false });
+  }
+  return endpoint;
 }
 
 // src/progress.ts
@@ -6887,38 +6962,38 @@ async function followPublication(p, endpoint, o, opts) {
   }
   const [ref, commit] = refs[0];
   opts.log("Following it to live: received -> checked -> going live -> live. Ctrl-C stops watching; the publication is saved and carries on without you.");
-  const outcome = await p.followRun(
+  const outcome2 = await p.followRun(
     { portal, repoId: o.repoId, publicationId: o.publicationId, ref, commit },
     { onStage: opts.onStage, ...opts.timeoutMs === void 0 ? {} : { timeoutMs: opts.timeoutMs }, ...opts.untilChange === true ? { untilChange: true } : {} }
   ).finally(() => opts.stopStages?.());
   const answerable = confirmed.terminal.includes(PREPARATION);
   const dir = shellWord(opts.dir);
-  const next = outcome.kind === "timed-out" || outcome.kind === "moving" ? { action: "follow", command: `publisher follow ${dir} --publication ${o.publicationId}${opts.untilChange === true ? " --until-change" : ""} --json` } : outcome.kind === "waiting" && answerable ? { action: "question", command: `publisher question ${dir} --json` } : void 0;
-  const findings = await failedChecks(p, portal, o.repoId, outcome, answerable);
+  const next = outcome2.kind === "timed-out" || outcome2.kind === "moving" ? { action: "follow", command: `publisher follow ${dir} --publication ${o.publicationId}${opts.untilChange === true ? " --until-change" : ""} --json` } : outcome2.kind === "waiting" && answerable ? { action: "question", command: `publisher question ${dir} --json` } : void 0;
+  const findings = await failedChecks(p, portal, o.repoId, outcome2, answerable);
   if (findings !== null) {
     return {
-      ...outcome,
+      ...outcome2,
       portal,
       hint: `It did not pass its checks (${findings.length === 1 ? "one finding" : `${findings.length} findings`}). Fix each finding in the app folder, then run next.command to publish again.`,
       findings,
       next: { action: "fix", command: `publisher sync ${dir} --until-change --json` }
     };
   }
-  return { ...outcome, portal, hint: progressHint(outcome, portal, answerable), ...next === void 0 ? {} : { next } };
+  return { ...outcome2, portal, hint: progressHint(outcome2, portal, answerable), ...next === void 0 ? {} : { next } };
 }
-async function failedChecks(p, portal, repoId, outcome, served) {
-  if (!served || outcome.kind !== "settled" || outcome.ending !== "failed" || outcome.runId === null) {
+async function failedChecks(p, portal, repoId, outcome2, served) {
+  if (!served || outcome2.kind !== "settled" || outcome2.ending !== "failed" || outcome2.runId === null) {
     return null;
   }
-  if (outcome.stages.find((s) => s.state === "failed")?.stage !== "running") {
+  if (outcome2.stages.find((s) => s.state === "failed")?.stage !== "running") {
     return null;
   }
   try {
-    const answer = await p.readPreparation({ portal, repoId });
-    if (answer.kind !== "view" || answer.view.id !== outcome.runId || answer.view.status !== "blocked") {
+    const answer2 = await p.readPreparation({ portal, repoId });
+    if (answer2.kind !== "view" || answer2.view.id !== outcome2.runId || answer2.view.status !== "blocked") {
       return null;
     }
-    return answer.view.findings.length === 0 ? null : answer.view.findings;
+    return answer2.view.findings.length === 0 ? null : answer2.view.findings;
   } catch {
     return null;
   }
@@ -6986,122 +7061,6 @@ function progressHint(r, portal, answerable = false) {
   }
 }
 
-// src/list.ts
-async function listApps(p, opts = {}) {
-  const page = await p.listRepositories({ state: opts.archived ? "archived" : "active", limit: 200, ...opts.cursor ? { cursor: opts.cursor } : {} });
-  const apps = page.repositories.map((r) => ({
-    repoId: r.repoId,
-    name: r.name,
-    createdAt: r.createdAt,
-    publishedAt: r.lastTransaction?.committedAt ?? null,
-    archived: r.archived,
-    checkout: `publisher checkout ${shellWord(folderFor(r.name))} --repo ${r.repoId} --json`
-  })).sort((a, b) => (b.publishedAt ?? b.createdAt).localeCompare(a.publishedAt ?? a.createdAt));
-  const hint = apps.length === 0 ? "You have not published an app from this sign-in yet." : "To work on one in a new folder, run its checkout command.";
-  return { apps, nextCursor: page.nextCursor, hint };
-}
-function folderFor(name) {
-  const slug2 = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  return slug2 === "" ? "app" : slug2;
-}
-
-// src/init.ts
-async function repositoryForInit(p, endpoint, name, opts = {}) {
-  const portal = portalForEndpoint(endpoint);
-  if (portal === null) {
-    return { repoId: (await p.createRepository({ name, grants: [] })).repoId, appId: null };
-  }
-  const confirmed = await confirmPortal(portal, endpoint, opts.fetch);
-  if (confirmed === null) {
-    throw new PublisherError("UNAVAILABLE", `could not confirm that ${portal} publishes to ${endpoint}; run init again`, { retryable: true });
-  }
-  if (!confirmed.terminal.includes(APPLICATION_CREATION)) {
-    throw new PublisherError("UNAVAILABLE", `${portal} cannot make an application from a terminal yet, and a repository needs one; ask whoever runs it to update the portal`);
-  }
-  const made = await p.createApplication({ portal, name });
-  return { repoId: made.repository.repoId, appId: made.appId };
-}
-
-// src/args.ts
-var import_node_util2 = require("node:util");
-var OPTIONS = {
-  endpoint: { type: "string" },
-  profile: { type: "string" },
-  token: { type: "string" },
-  portal: { type: "string" },
-  name: { type: "string" },
-  repo: { type: "string" },
-  message: { type: "string" },
-  publication: { type: "string" },
-  timeout: { type: "string" },
-  branch: { type: "string" },
-  ours: { type: "string" },
-  theirs: { type: "string" },
-  to: { type: "string" },
-  cursor: { type: "string" },
-  ref: { type: "string", multiple: true },
-  json: { type: "boolean" },
-  quiet: { type: "boolean" },
-  force: { type: "boolean" },
-  apply: { type: "boolean" },
-  "mark-conflicts": { type: "boolean" },
-  help: { type: "boolean" },
-  version: { type: "boolean" },
-  "set-default": { type: "boolean" },
-  archived: { type: "boolean" },
-  // A flag of its own, not a negation of --wait: there is no --wait.
-  "no-wait": { type: "boolean" },
-  "until-change": { type: "boolean" },
-  // `login --continue`: finish the sign-in a `login --no-wait` started.
-  continue: { type: "boolean" }
-};
-function str2(v) {
-  return typeof v === "string" ? v : void 0;
-}
-function parseArgs(argv) {
-  try {
-    const { positionals, values } = (0, import_node_util2.parseArgs)({ args: argv, options: OPTIONS, allowPositionals: true, strict: true });
-    return { cmd: positionals, flags: { ...values } };
-  } catch (e) {
-    throw new PublisherError("INVALID_REQUEST", e instanceof Error ? e.message : String(e));
-  }
-}
-
-// src/discover.ts
-var DEFAULT_PORTAL_URL = "https://shadow.minnovate.ai";
-function portalBase(env, flag) {
-  return (flag ?? env["GIT_PUBLISHER_PORTAL"] ?? DEFAULT_PORTAL_URL).replace(/\/+$/, "");
-}
-var DISCOVER_TIMEOUT_MS = 1e4;
-async function discoverEndpoint(portal, fetchImpl = fetch) {
-  const url2 = `${portal}/api/v1/config`;
-  const bound = new AbortController();
-  const timer = setTimeout(() => bound.abort(new DOMException("the request timed out", "TimeoutError")), DISCOVER_TIMEOUT_MS);
-  let body;
-  try {
-    const response = await fetchImpl(url2, { signal: bound.signal });
-    if (!response.ok) {
-      throw new PublisherError("UNAVAILABLE", `could not ask ${portal} where to publish (it answered ${response.status})`, { retryable: true });
-    }
-    body = await response.json();
-  } catch (e) {
-    if (PublisherError.isPublisherError(e)) {
-      throw e;
-    }
-    throw new PublisherError("NETWORK", `could not reach ${portal}: ${e instanceof Error ? e.message : String(e)}`, { retryable: true });
-  } finally {
-    clearTimeout(timer);
-  }
-  const endpoint = body?.publishingEndpoint;
-  if (endpoint === null || endpoint === void 0) {
-    throw new PublisherError("LOCAL_STATE", `${portal} is not set up for publishing; ask whoever runs it, or pass --endpoint`);
-  }
-  if (typeof endpoint !== "string" || endpoint.trim() === "") {
-    throw new PublisherError("UNAVAILABLE", `${portal} answered with something this version does not understand`, { retryable: false });
-  }
-  return endpoint;
-}
-
 // src/prompt.ts
 var import_promises11 = require("node:readline/promises");
 function isInteractive(env) {
@@ -7110,8 +7069,8 @@ function isInteractive(env) {
 function suggestProfileName(endpoint, taken) {
   return hasReadableName(endpoint) ? profileNameFor(endpoint, taken) : null;
 }
-function resolveChoice(answer, names) {
-  const a = answer.trim();
+function resolveChoice(answer2, names) {
+  const a = answer2.trim();
   if (!a) {
     return null;
   }
@@ -7121,10 +7080,10 @@ function resolveChoice(answer, names) {
   }
   return names.find((n) => n.toLowerCase() === a.toLowerCase()) ?? null;
 }
-async function ask3(question) {
+async function ask3(question2) {
   const rl = (0, import_promises11.createInterface)({ input: process.stdin, output: process.stderr });
   try {
-    return await rl.question(question);
+    return await rl.question(question2);
   } catch {
     return null;
   } finally {
@@ -7139,12 +7098,12 @@ ${purpose}
   names.forEach((n, i) => process.stderr.write(`  ${i + 1}) ${n}
 `));
   for (let attempt = 0; attempt < 3; attempt++) {
-    const answer = await ask3(`
+    const answer2 = await ask3(`
 Which one? [1-${names.length}, or a name] `);
-    if (answer === null) {
+    if (answer2 === null) {
       return null;
     }
-    const chosen = resolveChoice(answer, names);
+    const chosen = resolveChoice(answer2, names);
     if (chosen) {
       return chosen;
     }
@@ -7159,13 +7118,13 @@ Name this connection, so you never have to type ${endpoint} again.
 (for example: prod, dev, staging)
 `);
   for (let attempt = 0; attempt < 3; attempt++) {
-    const answer = await ask3(suggested ? `
+    const answer2 = await ask3(suggested ? `
 Profile name [${suggested}]: ` : `
 Profile name: `);
-    if (answer === null) {
+    if (answer2 === null) {
       return null;
     }
-    const name = answer.trim() || suggested;
+    const name = answer2.trim() || suggested;
     if (name && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name)) {
       return name;
     }
@@ -7266,17 +7225,17 @@ async function login(ctx) {
     throw new PublisherError("INVALID_REQUEST", "login requires --endpoint (or --profile naming a stored one)");
   }
   clock.lap("discovery");
-  const profile = str2(ctx.flags["profile"]);
+  const profile2 = str2(ctx.flags["profile"]);
   const setDefault = ctx.flags["set-default"] === true;
   const given = str2(ctx.flags["token"]) ?? process.env["GIT_PUBLISHER_TOKEN"];
   if (given) {
-    return finish(ctx, { endpoint, token: given, signIn: null, profile, setDefault }, clock);
+    return finish(ctx, { endpoint, token: given, signIn: null, profile: profile2, setDefault }, clock);
   }
   if (ctx.flags["no-wait"] === true) {
     const started = await startDeviceLogin({ endpoint });
     clock.lap("start");
     prompt(started);
-    const pendingFile = await savePendingLogin({ endpoint, started, ...profile ? { profile } : {}, ...setDefault ? { setDefault } : {} });
+    const pendingFile = await savePendingLogin({ endpoint, started, ...profile2 ? { profile: profile2 } : {}, ...setDefault ? { setDefault } : {} });
     ctx.out(pendingResult(endpoint, started, "Have the code approved, then run next.command to finish signing in.", clock, { pendingFile }));
     return 0;
   }
@@ -7288,7 +7247,7 @@ async function login(ctx) {
     }
   });
   clock.lap("approval");
-  return finish(ctx, { endpoint, token: signIn.token, signIn, profile, setDefault }, clock);
+  return finish(ctx, { endpoint, token: signIn.token, signIn, profile: profile2, setDefault }, clock);
 }
 async function continueLogin(ctx) {
   const clock = stopwatch();
@@ -7340,20 +7299,20 @@ async function finish(ctx, got, clock) {
   const { endpoint, token, signIn } = got;
   const caps = await verifiedCapabilities(createPublisher({ endpoint, token }));
   clock.lap("verify");
-  let profile = got.profile;
-  if (!profile && isInteractive({ json: ctx.json, isTTY: process.stdin.isTTY })) {
+  let profile2 = got.profile;
+  if (!profile2 && isInteractive({ json: ctx.json, isTTY: process.stdin.isTTY })) {
     const suggested = suggestProfileName(endpoint, new Set(Object.keys(ctx.input.file.profiles)));
-    profile = await askProfileName(endpoint, suggested) ?? void 0;
+    profile2 = await askProfileName(endpoint, suggested) ?? void 0;
   }
   const path = await saveCredential(endpoint, token, void 0, {
-    ...profile ? { profile } : {},
+    ...profile2 ? { profile: profile2 } : {},
     setDefault: got.setDefault,
     // The refresh half, when the service issued one: the sign-in outlives the credential.
     ...signIn ? { signIn } : {}
   });
   const file = await readCredentials();
   clock.lap("save");
-  const named = profileForEndpoint(file, endpoint, profile);
+  const named = profileForEndpoint(file, endpoint, profile2);
   const timings = clock.read();
   ctx.log(timingsLine(timings));
   ctx.out({
@@ -7370,6 +7329,67 @@ async function finish(ctx, got, clock) {
   return 0;
 }
 
+// src/commands/account.ts
+var login2 = {
+  git: false,
+  async run(inv) {
+    return login({ flags: inv.flags, json: inv.json, out: inv.out, log: inv.log, input: await inv.resolutionInput() });
+  }
+};
+var logout = {
+  git: false,
+  async run(inv) {
+    const profile2 = inv.str("profile");
+    const endpoint = inv.str("endpoint") ?? process.env["GIT_PUBLISHER_ENDPOINT"];
+    if (!profile2 && !endpoint) {
+      throw new PublisherError("INVALID_REQUEST", "logout requires --endpoint or --profile");
+    }
+    const { revoked } = profile2 ? await removeProfile(profile2, { revoke: true }) : await removeCredential(endpoint, { revoke: true });
+    inv.out({ ok: true, ...profile2 ? { profile: profile2 } : { endpoint }, revoked });
+    return 0;
+  }
+};
+var profile = {
+  git: false,
+  async run(inv) {
+    const file = await readCredentials();
+    switch (inv.cmd[1]) {
+      case void 0:
+      case "list": {
+        const s = credentialStatus({ file, env: process.env });
+        inv.out({ profiles: s.profiles, defaultProfile: s.defaultProfile, credentialsFile: credentialsPath() });
+        return 0;
+      }
+      case "use": {
+        const name = inv.cmd[2];
+        if (!name) {
+          throw new PublisherError("INVALID_REQUEST", "profile use requires a name");
+        }
+        await setDefaultProfile(name);
+        inv.out({ ok: true, defaultProfile: name, endpoint: file.profiles[name].endpoint });
+        return 0;
+      }
+      case "remove": {
+        const name = inv.cmd[2];
+        if (!name) {
+          throw new PublisherError("INVALID_REQUEST", "profile remove requires a name");
+        }
+        await removeProfile(name);
+        inv.out({ ok: true, removed: name });
+        return 0;
+      }
+      default:
+        throw new PublisherError("INVALID_REQUEST", `unknown profile command: ${inv.cmd[1]}; expected list, use or remove`);
+    }
+  }
+};
+
+// src/git-minimum.ts
+var CLIENT_GIT_MINIMUM = "2.43.0";
+function gitSupported(version2) {
+  return compareVersions(version2, CLIENT_GIT_MINIMUM) >= 0;
+}
+
 // src/skills.ts
 var import_node_child_process3 = require("node:child_process");
 var import_node_fs7 = require("node:fs");
@@ -7387,14 +7407,14 @@ function packageVersion() {
   }
 }
 function claude(args) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let stdout = "";
     let stderr = "";
     const child = (0, import_node_child_process3.spawn)("claude", args, { stdio: ["ignore", "pipe", "pipe"] });
     child.stdout.on("data", (d) => stdout += d.toString("utf8"));
     child.stderr.on("data", (d) => stderr += d.toString("utf8"));
-    child.on("error", (e) => resolve3({ code: null, stdout, stderr: e.message, missing: e.code === "ENOENT" }));
-    child.on("close", (code) => resolve3({ code, stdout, stderr, missing: false }));
+    child.on("error", (e) => resolve4({ code: null, stdout, stderr: e.message, missing: e.code === "ENOENT" }));
+    child.on("close", (code) => resolve4({ code, stdout, stderr, missing: false }));
   });
 }
 async function installSkills({ log }) {
@@ -7427,21 +7447,290 @@ async function installSkills({ log }) {
   };
 }
 
-// src/question.ts
-async function questionAt(p, endpoint, repoId, opts = {}) {
-  const at = await portalAt(endpoint, opts);
-  if ("reason" in at) {
-    return at;
+// src/tempdir.ts
+var import_node_fs8 = require("node:fs");
+var import_promises12 = require("node:fs/promises");
+var import_node_os4 = require("node:os");
+var FALLBACK_TEMP_DIRS = ["/tmp", "/var/tmp"];
+async function unusable(path) {
+  try {
+    if (!(await (0, import_promises12.stat)(path)).isDirectory()) {
+      return "is not a directory";
+    }
+  } catch {
+    return "does not exist";
   }
-  return shown(at.portal, await p.readPreparation({ portal: at.portal, repoId }));
-}
-async function answerAt(p, endpoint, repoId, specs, opts = {}) {
-  const answers = parseSpecs(specs);
-  const at = await portalAt(endpoint, opts);
-  if ("reason" in at) {
-    return at;
+  try {
+    await (0, import_promises12.access)(path, import_node_fs8.constants.W_OK | import_node_fs8.constants.X_OK);
+    return null;
+  } catch {
+    return "cannot be written";
   }
-  const read2 = shown(at.portal, await p.readPreparation({ portal: at.portal, repoId }));
+}
+async function ensureTempDir(env = process.env, fallbacks = FALLBACK_TEMP_DIRS) {
+  const named = (0, import_node_os4.tmpdir)();
+  const reason = await unusable(named);
+  if (reason === null) {
+    return { path: named, replaced: null };
+  }
+  for (const candidate of fallbacks) {
+    if (candidate !== named && await unusable(candidate) === null) {
+      env["TMPDIR"] = candidate;
+      return { path: candidate, replaced: { path: named, reason } };
+    }
+  }
+  throw new PublisherError(
+    "LOCAL_STATE",
+    `the temporary directory ${named} ${reason}, and neither ${fallbacks.join(" nor ")} can be used: set TMPDIR to a directory that can be written`,
+    {
+      details: { tempDir: named, reason, tried: [...fallbacks] }
+    }
+  );
+}
+function replacedLine(t) {
+  return t.replaced === null ? null : `note: the temporary directory ${t.replaced.path} ${t.replaced.reason}; using ${t.path} instead`;
+}
+
+// src/commands/environment.ts
+var doctor = {
+  git: false,
+  async run(inv) {
+    const temp = await ensureTempDir().catch((e) => e instanceof PublisherError ? { error: e.message } : null);
+    const git = await gitVersion().catch(() => null);
+    const dir = inv.dirArg(1);
+    const s = credentialStatus(await inv.resolutionInput(dir));
+    const association = await isGitRepo(dir) ? await readAssociation(dir) : null;
+    const probe = association ? await probeEndpoint(association.endpoint) : null;
+    inv.out({
+      node: process.version,
+      git,
+      gitOk: git !== null && gitSupported(git),
+      endpoint: s.resolution.kind === "resolved" ? s.resolution.endpoint : null,
+      endpointSource: s.resolution.kind === "resolved" ? s.resolution.source : null,
+      profile: s.resolution.kind === "resolved" ? s.resolution.profile ?? null : null,
+      credentials: s.credentials,
+      // What to do next and how to put it to the person, so the caller never has to invent it.
+      next: nextStep(s),
+      // The discriminated resolution, so a caller can tell "no credential for a settled endpoint"
+      // from "the profile you named does not exist" — both of which report credentials "missing".
+      resolution: s.resolution,
+      profiles: s.profiles,
+      defaultProfile: s.defaultProfile,
+      credentialsFile: credentialsPath(),
+      tempDir: temp,
+      association: association === null ? null : { endpoint: association.endpoint, repoId: association.repoId },
+      // Printed as it comes: `moved` carries where to, `unreachable` carries why, and the two
+      // need different next steps so they are not collapsed into "not ok".
+      associationStatus: probe
+    });
+    return git ? 0 : 1;
+  }
+};
+var migrate = {
+  git: false,
+  async run(inv) {
+    const dir = inv.dirArg(1);
+    const result = await migrateAssociation({ repoDir: dir, ...inv.optStr("to") });
+    const command = `publisher login --endpoint ${result.to} --json`;
+    inv.log(`re-pointed ${dir}: ${result.from} -> ${result.to}; sign in there with: ${command}`);
+    inv.out({ ...result, next: { action: "reauthenticate", ask: null, command } });
+    return 0;
+  }
+};
+var skills = {
+  git: false,
+  async run(inv) {
+    if (inv.cmd[1] !== "install") {
+      throw new PublisherError("INVALID_REQUEST", `unknown skills command: ${inv.cmd[1] ?? "(none)"}; expected install`);
+    }
+    const r = await installSkills({ log: inv.log });
+    inv.out(r);
+    return 0;
+  }
+};
+
+// src/init.ts
+async function repositoryForInit(p, endpoint, name, opts = {}) {
+  const portal = portalForEndpoint(endpoint);
+  if (portal === null) {
+    return { repoId: (await p.createRepository({ name, grants: [] })).repoId, appId: null };
+  }
+  const confirmed = await confirmPortal(portal, endpoint, opts.fetch);
+  if (confirmed === null) {
+    throw new PublisherError("UNAVAILABLE", `could not confirm that ${portal} publishes to ${endpoint}; run init again`, { retryable: true });
+  }
+  if (!confirmed.terminal.includes(APPLICATION_CREATION)) {
+    throw new PublisherError("UNAVAILABLE", `${portal} cannot make an application from a terminal yet, and a repository needs one; ask whoever runs it to update the portal`);
+  }
+  const made = await p.createApplication({ portal, name });
+  return { repoId: made.repository.repoId, appId: made.appId };
+}
+
+// src/commands/link.ts
+var init = {
+  git: true,
+  async run(inv) {
+    const dir = inv.dirArg(1);
+    const { p, endpoint } = await inv.client();
+    const repo = inv.str("repo");
+    const linked = await linkFolder(inv, p, endpoint, dir, repo ? { repoId: repo } : {});
+    inv.out({ ok: true, ...linked, endpoint, dir });
+    return 0;
+  }
+};
+async function linkFolder(inv, p, endpoint, dir, attach) {
+  let onboarding = null;
+  if (!await isGitRepo(dir) || !await headCommit(dir)) {
+    onboarding = await onboardFolder({ dir, ...inv.optStr("message") });
+    inv.log(`prepared ${onboarding.committed.length} files (${onboarding.excluded.length} excluded)`);
+  }
+  let repoId = attach.repoId ?? null;
+  let appId = null;
+  if (repoId === null) {
+    const made = await repositoryForInit(p, endpoint, inv.str("name") ?? dir.split("/").pop() ?? "");
+    repoId = made.repoId;
+    appId = made.appId;
+  } else {
+    await p.getRepository(repoId);
+  }
+  await p.associate(dir, repoId);
+  const workspace = await p.adoptWorkspace(dir).catch(() => null);
+  return {
+    repoId,
+    appId,
+    created: attach.repoId === void 0,
+    onboarding: onboarding ? { commit: onboarding.commit, committed: onboarding.committed.length, excluded: onboarding.excluded } : null,
+    workspace: workspace === null ? null : { branch: workspace.branch, baseOid: workspace.baseOid, baseGeneration: workspace.baseGeneration }
+  };
+}
+
+// src/commands/publication.ts
+var publish2 = {
+  git: true,
+  async run(inv) {
+    const dir = inv.dirArg(1);
+    const { p } = await inv.client(dir);
+    const refs = Array.isArray(inv.flags["ref"]) ? inv.flags["ref"] : [];
+    const force = inv.flags["force"] === true;
+    const updates = refs.length ? refs.map((r) => ({ ref: r.startsWith("refs/") ? r : `refs/heads/${r}`, force })) : void 0;
+    if (!updates && force) {
+      const b = await currentBranch(dir);
+      if (!b) {
+        throw new PublisherError("LOCAL_STATE", "detached HEAD");
+      }
+      return published(inv, await p.publish({ repoDir: dir, updates: [{ ref: b, force: true }], wait: inv.flags["no-wait"] !== true }, { onProgress: inv.progress }));
+    }
+    return published(inv, await p.publish({ repoDir: dir, ...updates ? { updates } : {}, wait: inv.flags["no-wait"] !== true }, { onProgress: inv.progress }));
+  }
+};
+function published(inv, o) {
+  inv.out({
+    state: o.state,
+    publicationId: o.publicationId,
+    repoId: o.repoId,
+    generation: o.resultGeneration,
+    refs: o.refs,
+    rejection: o.rejection,
+    resumed: o.resumed,
+    ...o.next === null ? {} : { next: o.next }
+  });
+  return exitFor(o.state);
+}
+function exitFor(state) {
+  return state === "accepted" ? 0 : state === "rejected" ? 2 : 3;
+}
+var status = {
+  git: true,
+  async run(inv) {
+    const dir = inv.dirArg(1);
+    const { p } = await inv.client(dir);
+    const pubId = inv.str("publication");
+    if (pubId) {
+      const repoId = await inv.repoId(dir);
+      const s = await p.getPublicationStatus(repoId, pubId);
+      inv.out(s);
+      return exitFor(s.state);
+    }
+    const pending = await p.pendingPublications(dir);
+    if (pending.length === 0) {
+      inv.out({ pending: [], resolved: [] });
+      return 0;
+    }
+    const resolved = await p.resumePublications(dir, { onProgress: inv.progress });
+    inv.out({
+      pending: pending.map((x) => x.publicationId),
+      resolved: resolved.map((o) => ({
+        publicationId: o.publicationId,
+        state: o.state,
+        generation: o.resultGeneration,
+        rejection: o.rejection,
+        ...o.next === null ? {} : { next: o.next }
+      }))
+    });
+    return resolved.every((o) => o.state === "accepted") ? 0 : resolved.some((o) => o.state === "rejected") ? 2 : 3;
+  }
+};
+var follow = {
+  git: false,
+  async run(inv) {
+    const dir = inv.dirArg(1);
+    const publicationId = inv.str("publication");
+    if (!publicationId) {
+      throw new PublisherError("INVALID_REQUEST", "follow requires --publication <id>");
+    }
+    const timeoutMs = followTimeoutMs(inv.str("timeout"));
+    const { p, endpoint } = await inv.client(dir);
+    const repoId = await inv.repoId(dir);
+    const publication = await p.getPublicationStatus(repoId, publicationId);
+    if (publication.state !== "accepted") {
+      throw new PublisherError("LOCAL_STATE", `publication ${publicationId} is ${publication.state}, not accepted; run publisher status`);
+    }
+    const clock = stopwatch();
+    const followed = await followPublication(p, endpoint, publication, { ...inv.following, timeoutMs, dir });
+    const timings = clock.read("stages" in followed ? runTimings(followed.stages, null) : {});
+    inv.log(timingsLine(timings));
+    inv.out({ publicationId, progress: followed, timings });
+    return 0;
+  }
+};
+
+// src/commands/repository.ts
+var import_node_path9 = require("node:path");
+
+// src/list.ts
+async function listApps(p, opts = {}) {
+  const page = await p.listRepositories({ state: opts.archived ? "archived" : "active", limit: 200, ...opts.cursor ? { cursor: opts.cursor } : {} });
+  const apps = page.repositories.map((r) => ({
+    repoId: r.repoId,
+    name: r.name,
+    createdAt: r.createdAt,
+    publishedAt: r.lastTransaction?.committedAt ?? null,
+    archived: r.archived,
+    checkout: `publisher checkout ${shellWord(folderFor(r.name))} --repo ${r.repoId} --json`
+  })).sort((a, b) => (b.publishedAt ?? b.createdAt).localeCompare(a.publishedAt ?? a.createdAt));
+  const hint = apps.length === 0 ? "You have not published an app from this sign-in yet." : "To work on one in a new folder, run its checkout command.";
+  return { apps, nextCursor: page.nextCursor, hint };
+}
+function folderFor(name) {
+  const slug2 = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return slug2 === "" ? "app" : slug2;
+}
+
+// src/question.ts
+async function questionAt(p, endpoint, repoId, opts = {}) {
+  const at = await portalAt(endpoint, opts);
+  if ("reason" in at) {
+    return at;
+  }
+  return shown(at.portal, await p.readPreparation({ portal: at.portal, repoId }));
+}
+async function answerAt(p, endpoint, repoId, specs, opts = {}) {
+  const answers = parseSpecs(specs);
+  const at = await portalAt(endpoint, opts);
+  if ("reason" in at) {
+    return at;
+  }
+  const read2 = shown(at.portal, await p.readPreparation({ portal: at.portal, repoId }));
   if (read2.kind !== "view") {
     return read2;
   }
@@ -7449,13 +7738,13 @@ async function answerAt(p, endpoint, repoId, specs, opts = {}) {
     throw new PublisherError("LOCAL_STATE", `nothing is waiting for an answer (the preparation is ${read2.preparation.status})`);
   }
   for (const [id, value] of Object.entries(answers)) {
-    const question = read2.questions.find((q) => q.id === id);
-    if (question === void 0) {
+    const question2 = read2.questions.find((q) => q.id === id);
+    if (question2 === void 0) {
       throw new PublisherError("INVALID_REQUEST", `no pending question "${id}"; pending: ${read2.questions.map((q) => q.id).join(", ")}`, {
         details: { questions: read2.questions }
       });
     }
-    const values = question.options.map((o) => o.value);
+    const values = question2.options.map((o) => o.value);
     if (!values.includes(value)) {
       throw new PublisherError("INVALID_REQUEST", `"${value}" is not one of ${values.join(", ")} for "${id}"`, { details: { questions: read2.questions } });
     }
@@ -7515,50 +7804,166 @@ function hintFor(view) {
   return `It is waiting for your answer. Run: publisher answer ${how}`;
 }
 
-// src/tempdir.ts
-var import_node_fs8 = require("node:fs");
-var import_promises12 = require("node:fs/promises");
-var import_node_os4 = require("node:os");
-var FALLBACK_TEMP_DIRS = ["/tmp", "/var/tmp"];
-async function unusable(path) {
-  try {
-    if (!(await (0, import_promises12.stat)(path)).isDirectory()) {
-      return "is not a directory";
-    }
-  } catch {
-    return "does not exist";
+// src/commands/repository.ts
+var list = {
+  git: false,
+  async run(inv) {
+    inv.out(await listApps((await inv.client()).p, { archived: inv.flags["archived"] === true, cursor: inv.str("cursor") }));
+    return 0;
   }
-  try {
-    await (0, import_promises12.access)(path, import_node_fs8.constants.W_OK | import_node_fs8.constants.X_OK);
-    return null;
-  } catch {
-    return "cannot be written";
+};
+var info = {
+  git: false,
+  async run(inv) {
+    const dir = inv.dirArg(1);
+    const { p } = await inv.client(dir);
+    const repoId = await inv.repoId(dir);
+    inv.out(await p.getRepository(repoId));
+    return 0;
   }
-}
-async function ensureTempDir(env = process.env, fallbacks = FALLBACK_TEMP_DIRS) {
-  const named = (0, import_node_os4.tmpdir)();
-  const reason = await unusable(named);
-  if (reason === null) {
-    return { path: named, replaced: null };
+};
+var question = {
+  git: false,
+  async run(inv) {
+    const dir = inv.dirArg(1);
+    const { p, endpoint } = await inv.client(dir);
+    const repoId = await inv.repoId(dir);
+    inv.out({ repoId, ...await questionAt(p, endpoint, repoId) });
+    return 0;
   }
-  for (const candidate of fallbacks) {
-    if (candidate !== named && await unusable(candidate) === null) {
-      env["TMPDIR"] = candidate;
-      return { path: candidate, replaced: { path: named, reason } };
-    }
+};
+var answer = {
+  git: false,
+  async run(inv) {
+    const dir = (0, import_node_path9.resolve)(".");
+    const { p, endpoint } = await inv.client(dir);
+    const repoId = await inv.repoId(dir);
+    inv.out({ repoId, ...await answerAt(p, endpoint, repoId, inv.cmd.slice(1)) });
+    return 0;
   }
-  throw new PublisherError(
-    "LOCAL_STATE",
-    `the temporary directory ${named} ${reason}, and neither ${fallbacks.join(" nor ")} can be used: set TMPDIR to a directory that can be written`,
-    {
-      details: { tempDir: named, reason, tried: [...fallbacks] }
-    }
-  );
+};
+
+// src/commands/sync.ts
+var sync = {
+  git: true,
+  async run(inv) {
+    const dir = inv.dirArg(1);
+    const timeoutMs = followTimeoutMs(inv.str("timeout"));
+    const clock = stopwatch();
+    const { p, endpoint, source } = await inv.client(dir);
+    clock.lap("discovery");
+    await resolveToken(endpoint, inv.str("token"), { endpointSource: source });
+    clock.lap("authentication");
+    const linked = await isGitRepo(dir) && await readAssociation(dir) !== null ? null : await linkFolder(inv, p, endpoint, dir, {});
+    clock.lap("link", linked !== null);
+    const sending = splitAtBegin(clock, inv.progress);
+    const r = await p.syncChanges({ directory: dir, markConflicts: inv.flags["mark-conflicts"] === true, ...inv.optStr("message") }, { onProgress: sending.onProgress });
+    const acceptedAt = sending.done();
+    const o = r.published;
+    const followed = o !== null && o.state === "accepted" && inv.flags["no-wait"] !== true ? await followPublication(p, endpoint, o, { ...inv.following, timeoutMs, dir }) : null;
+    const syncTimings = clock.read(followed !== null && "stages" in followed ? runTimings(followed.stages, acceptedAt) : {});
+    inv.log(timingsLine(syncTimings));
+    inv.out({
+      ok: r.state === "published" || r.state === "up_to_date",
+      state: r.state,
+      linked: linked === null ? null : { repoId: linked.repoId, appId: linked.appId, created: linked.created },
+      ...outcome(r),
+      progress: followed,
+      timings: syncTimings
+    });
+    return r.state === "published" || r.state === "up_to_date" ? 0 : r.state === "unknown" ? 3 : 2;
+  }
+};
+function outcome(r) {
+  const o = r.published;
+  return {
+    recorded: r.recorded,
+    merged: r.reconciled.applied,
+    conflicts: r.reconciled.before.conflicts,
+    marked: r.marked,
+    publication: o === null ? null : {
+      state: o.state,
+      publicationId: o.publicationId,
+      generation: o.resultGeneration,
+      refs: o.refs,
+      rejection: o.rejection,
+      ...o.next === null ? {} : { next: o.next }
+    },
+    hint: syncHint(r.state, r.reconciled.before.conflicts, r.marked)
+  };
 }
-function replacedLine(t) {
-  return t.replaced === null ? null : `note: the temporary directory ${t.replaced.path} ${t.replaced.reason}; using ${t.path} instead`;
+function syncHint(state, conflicts, marked) {
+  switch (state) {
+    case "published":
+      return "Your changes are saved and published.";
+    case "up_to_date":
+      return "Nothing new to publish: the service already has this version.";
+    case "conflict":
+      return marked ? `Both versions are now in ${conflicts.join(", ")}, between <<<<<<< and >>>>>>> lines. Edit each to what should be kept, remove those lines, then run publisher sync.` : `Your changes and the published version both changed ${conflicts.join(", ")}. Nothing was published and nothing was lost; decide which version to keep.`;
+    case "rejected":
+      return "The service refused the publication; see publication.rejection.";
+    default:
+      return "The publication was sent but its outcome is not known yet; run publisher status.";
+  }
 }
 
+// src/commands/workspace.ts
+var fetch2 = {
+  git: true,
+  async run(inv) {
+    const dir = inv.dirArg(1);
+    const { p } = await inv.client(dir);
+    const r = await p.fetch({ repoDir: dir }, { onProgress: inv.progress });
+    inv.out({ ok: true, repoId: r.repoId, generation: r.generation, remote: r.remote, refs: r.refs, tracking: r.tracking, bytes: r.bytes });
+    return 0;
+  }
+};
+var checkout = {
+  git: true,
+  async run(inv) {
+    const dir = inv.dirArg(1);
+    const repoId = inv.str("repo");
+    if (!repoId) {
+      throw new PublisherError("INVALID_REQUEST", "checkout requires --repo <id>");
+    }
+    const { p } = await inv.client();
+    const branch = inv.str("branch");
+    const m = await p.checkout({ directory: dir, repoId, ...branch ? { branch } : {} }, { onProgress: inv.progress });
+    inv.out({ ok: true, workspace: m });
+    return 0;
+  }
+};
+var workspaceStatus = {
+  git: true,
+  async run(inv) {
+    const dir = inv.dirArg(1);
+    const { p } = await inv.client(dir);
+    const s = await p.workspaceStatus(dir, { onProgress: inv.progress });
+    inv.out(s);
+    return s.state === "conflict" ? 2 : 0;
+  }
+};
+var mergeCheck2 = {
+  git: true,
+  async run(inv) {
+    const dir = inv.dirArg(1);
+    const ours = inv.str("ours");
+    const theirs = inv.str("theirs");
+    if (!ours || !theirs) {
+      throw new PublisherError("INVALID_REQUEST", "merge-check requires --ours and --theirs");
+    }
+    const r = await mergeRemote({
+      repoDir: dir,
+      ours: ours.startsWith("refs/") ? ours : `refs/heads/${ours}`,
+      theirs,
+      apply: inv.flags["apply"] === true,
+      ...inv.optStr("message")
+    });
+    inv.out(r);
+    return r.ok ? 0 : 2;
+  }
+};
+
 // src/exit-code.ts
 var EXIT_CODE = {
   UNAUTHORIZED: 4,
@@ -7603,7 +8008,124 @@ function exitCodeFor(code) {
   return EXIT_CODE[code];
 }
 
-// src/main.ts
+// src/invocation.ts
+var import_node_path10 = require("node:path");
+var Invocation = class {
+  cmd;
+  flags;
+  json;
+  quiet;
+  /** How a run is followed: each stage as it is seen (`stageEmitter`), and with --until-change back at each step. */
+  following;
+  constructor({ cmd, flags }) {
+    this.cmd = cmd;
+    this.flags = flags;
+    this.json = flags["json"] === true;
+    this.quiet = flags["quiet"] === true || this.json;
+    this.following = { ...stageEmitter(this.json, this.quiet), log: this.log, untilChange: flags["until-change"] === true };
+  }
+  out = (v) => {
+    process.stdout.write((this.json ? JSON.stringify(v) : formatHuman(v)) + "\n");
+  };
+  log = (s) => {
+    if (!this.quiet) {
+      process.stderr.write(s + "\n");
+    }
+  };
+  /** The repository a command acts on: `--repo`, or else the one this folder is associated with. */
+  async repoId(dir) {
+    const repoId = this.str("repo") ?? (await readAssociation(dir))?.repoId;
+    if (!repoId) {
+      throw new PublisherError("LOCAL_STATE", "no repository association; pass --repo");
+    }
+    return repoId;
+  }
+  progress = (e) => {
+    if (this.quiet) {
+      return;
+    }
+    const pct = e.total ? ` ${Math.round((e.bytes ?? 0) / e.total * 100)}%` : "";
+    process.stderr.write(`\r[${e.phase}] ${e.message}${pct}          `);
+    if (e.phase === "done") {
+      process.stderr.write("\n");
+    }
+  };
+  /** The folder named at position `i` of the command path, or the current one. */
+  dirArg(i) {
+    return (0, import_node_path10.resolve)(this.cmd[i] ?? ".");
+  }
+  /** A flag's value when it is a string, else undefined. */
+  str(key) {
+    return str2(this.flags[key]);
+  }
+  /** `{ [key]: value }` when the flag is a non-empty string, else nothing to spread. */
+  optStr(key) {
+    const v = this.str(key);
+    return v ? { [key]: v } : {};
+  }
+  async resolutionInput(dir) {
+    let association;
+    if (dir && await isGitRepo(dir)) {
+      association = (await readAssociation(dir))?.endpoint;
+    }
+    return {
+      ...this.optStr("endpoint"),
+      ...this.optStr("profile"),
+      env: process.env,
+      ...association ? { association } : {},
+      file: await readCredentials()
+    };
+  }
+  /**
+   * Resolve, and on the one ambiguous case ASK rather than refuse — but only at a real terminal
+   * whose output a person is reading. Everywhere else (an agent's --json, CI) `demand` still fails
+   * with the names in `error.details.profiles`, because a prompt there is a hang.
+   */
+  async endpointFor(dir) {
+    const input = await this.resolutionInput(dir);
+    const r = resolveEndpoint(input);
+    if (r.kind === "ambiguous" && isInteractive({ json: this.json, isTTY: process.stdin.isTTY })) {
+      const chosen = await chooseProfile(r.profiles, "You have more than one connection, and none is the default.");
+      if (chosen) {
+        this.log(`Using ${chosen}. Make it permanent with: publisher profile use ${chosen}`);
+        return demand(resolveEndpoint({ ...input, profile: chosen }), input);
+      }
+    }
+    return demand(r, input);
+  }
+  async client(dir) {
+    const { endpoint, source } = await this.endpointFor(dir);
+    const token = this.str("token");
+    return {
+      endpoint,
+      source,
+      p: createPublisher({ endpoint, endpointSource: source, ...token ? { token } : {}, clientName: "git-publisher-cli", clientVersion: CLIENT_VERSION })
+    };
+  }
+};
+async function demand(r, input) {
+  if (r.kind === "resolved") {
+    return r;
+  }
+  const next = nextStep(credentialStatus(input));
+  const details = { profiles: r.kind === "none" ? [] : r.profiles, next };
+  const run = next.command === null ? "" : ` Run: ${next.command}`;
+  switch (r.kind) {
+    case "unknown-profile":
+      throw new PublisherError("LOCAL_STATE", `no such profile: ${r.name}.${run}`, { details });
+    case "ambiguous":
+      throw new PublisherError("LOCAL_STATE", `several connections and none is the default: pass --profile <name>, or choose one once.${run}`, { details });
+    case "none": {
+      const where = await whereCredentialsWere();
+      throw new PublisherError("LOCAL_STATE", `not connected to a publishing service yet: ${where.sentence}${run}`, { details: { ...details, credentialsFile: where.details } });
+    }
+  }
+}
+function formatHuman(v) {
+  return JSON.stringify(v, null, 2);
+}
+
+// src/usage.ts
 var USAGE = `publisher \u2014 publish an app's Git history to the serverless Git backend
 
 Usage:
@@ -7670,467 +8192,55 @@ Tokens come from --token, GIT_PUBLISHER_TOKEN, or the credentials file. A token
 GIT_PUBLISHER_TOKEN is used only with --endpoint, --profile, GIT_PUBLISHER_ENDPOINT or
 GIT_PUBLISHER_PROFILE, never with an endpoint the folder or a default profile supplied.
 `;
-function optStr(flags, key) {
-  const v = str2(flags[key]);
-  return v ? { [key]: v } : {};
-}
+
+// src/main.ts
+var COMMANDS = /* @__PURE__ */ new Map([
+  ["doctor", doctor],
+  ["migrate", migrate],
+  ["login", login2],
+  ["logout", logout],
+  ["profile", profile],
+  ["init", init],
+  ["publish", publish2],
+  ["status", status],
+  ["fetch", fetch2],
+  ["list", list],
+  ["checkout", checkout],
+  ["workspace-status", workspaceStatus],
+  ["sync", sync],
+  ["follow", follow],
+  ["question", question],
+  ["answer", answer],
+  ["skills", skills],
+  ["merge-check", mergeCheck2],
+  ["info", info]
+]);
 async function main(argv) {
-  const { cmd, flags } = parseArgs(argv);
-  const json = flags["json"] === true;
-  const quiet = flags["quiet"] === true || json;
-  const out = (v) => process.stdout.write((json ? JSON.stringify(v) : formatHuman(v)) + "\n");
-  const log = (s) => {
-    if (!quiet) {
-      process.stderr.write(s + "\n");
-    }
-  };
-  const progress = (e) => {
-    if (quiet) {
-      return;
-    }
-    const pct = e.total ? ` ${Math.round((e.bytes ?? 0) / e.total * 100)}%` : "";
-    process.stderr.write(`\r[${e.phase}] ${e.message}${pct}          `);
-    if (e.phase === "done") {
-      process.stderr.write("\n");
-    }
-  };
-  const dirArg = (i) => (0, import_node_path9.resolve)(cmd[i] ?? ".");
-  const following = { ...stageEmitter(json, quiet), log, untilChange: flags["until-change"] === true };
-  const resolutionInput = async (dir) => {
-    let association;
-    if (dir && await isGitRepo(dir)) {
-      association = (await readAssociation(dir))?.endpoint;
-    }
-    return {
-      ...optStr(flags, "endpoint"),
-      ...optStr(flags, "profile"),
-      env: process.env,
-      ...association ? { association } : {},
-      file: await readCredentials()
-    };
-  };
-  const endpointFor = async (dir) => {
-    const input = await resolutionInput(dir);
-    const r = resolveEndpoint(input);
-    if (r.kind === "ambiguous" && isInteractive({ json, isTTY: process.stdin.isTTY })) {
-      const chosen = await chooseProfile(r.profiles, "You have more than one connection, and none is the default.");
-      if (chosen) {
-        log(`Using ${chosen}. Make it permanent with: publisher profile use ${chosen}`);
-        return demand(resolveEndpoint({ ...input, profile: chosen }), input);
-      }
-    }
-    return demand(r, input);
-  };
-  const client = async (dir) => {
-    const { endpoint, source } = await endpointFor(dir);
-    const token = str2(flags["token"]);
-    return {
-      endpoint,
-      source,
-      p: createPublisher({ endpoint, endpointSource: source, ...token ? { token } : {}, clientName: "git-publisher-cli", clientVersion: CLIENT_VERSION })
-    };
-  };
-  const linkFolder = async (p, endpoint, dir, attach) => {
-    let onboarding = null;
-    if (!await isGitRepo(dir) || !await headCommit(dir)) {
-      onboarding = await onboardFolder({ dir, ...optStr(flags, "message") });
-      log(`prepared ${onboarding.committed.length} files (${onboarding.excluded.length} excluded)`);
-    }
-    let repoId = attach.repoId ?? null;
-    let appId = null;
-    if (repoId === null) {
-      const made = await repositoryForInit(p, endpoint, str2(flags["name"]) ?? dir.split("/").pop() ?? "");
-      repoId = made.repoId;
-      appId = made.appId;
-    } else {
-      await p.getRepository(repoId);
-    }
-    await p.associate(dir, repoId);
-    const workspace = await p.adoptWorkspace(dir).catch(() => null);
-    return {
-      repoId,
-      appId,
-      created: attach.repoId === void 0,
-      onboarding: onboarding ? { commit: onboarding.commit, committed: onboarding.committed.length, excluded: onboarding.excluded } : null,
-      workspace: workspace === null ? null : { branch: workspace.branch, baseOid: workspace.baseOid, baseGeneration: workspace.baseGeneration }
-    };
-  };
-  if (flags["version"] === true) {
+  const inv = new Invocation(parseArgs(argv));
+  const name = inv.cmd[0];
+  const help = inv.flags["help"] === true;
+  const command = name === void 0 ? void 0 : COMMANDS.get(name);
+  if (inv.flags["version"] === true) {
     process.stdout.write(`${packageVersion()}
 `);
     return 0;
   }
-  if (flags["help"] !== true && GIT_COMMANDS.has(cmd[0] ?? "")) {
+  if (!help && command?.git === true) {
     const line = replacedLine(await ensureTempDir());
     if (line !== null) {
       process.stderr.write(line + "\n");
     }
   }
-  switch (flags["help"] === true ? "help" : cmd[0]) {
-    case void 0:
-    case "help":
-      process.stdout.write(USAGE);
-      return 0;
-    case "doctor": {
-      const temp = await ensureTempDir().catch((e) => e instanceof PublisherError ? { error: e.message } : null);
-      const git = await gitVersion().catch(() => null);
-      const dir = dirArg(1);
-      const s = credentialStatus(await resolutionInput(dir));
-      const association = await isGitRepo(dir) ? await readAssociation(dir) : null;
-      const probe = association ? await probeEndpoint(association.endpoint) : null;
-      out({
-        node: process.version,
-        git,
-        gitOk: git !== null && gitSupported(git),
-        endpoint: s.resolution.kind === "resolved" ? s.resolution.endpoint : null,
-        endpointSource: s.resolution.kind === "resolved" ? s.resolution.source : null,
-        profile: s.resolution.kind === "resolved" ? s.resolution.profile ?? null : null,
-        credentials: s.credentials,
-        // What to do next and how to put it to the person, so the caller never has to invent it.
-        next: nextStep(s),
-        // The discriminated resolution, so a caller can tell "no credential for a settled endpoint"
-        // from "the profile you named does not exist" — both of which report credentials "missing".
-        resolution: s.resolution,
-        profiles: s.profiles,
-        defaultProfile: s.defaultProfile,
-        credentialsFile: credentialsPath(),
-        tempDir: temp,
-        association: association === null ? null : { endpoint: association.endpoint, repoId: association.repoId },
-        // Printed as it comes: `moved` carries where to, `unreachable` carries why, and the two
-        // need different next steps so they are not collapsed into "not ok".
-        associationStatus: probe
-      });
-      return git ? 0 : 1;
-    }
-    /**
-     * Re-point a folder whose service moved. The credential is not carried to the new address,
-     * which the old one chose, so the person signs in there.
-     */
-    case "migrate": {
-      const dir = dirArg(1);
-      const result = await migrateAssociation({ repoDir: dir, ...optStr(flags, "to") });
-      const command = `publisher login --endpoint ${result.to} --json`;
-      log(`re-pointed ${dir}: ${result.from} -> ${result.to}; sign in there with: ${command}`);
-      out({ ...result, next: { action: "reauthenticate", ask: null, command } });
-      return 0;
-    }
-    case "login":
-      return login({ flags, json, out, log, input: await resolutionInput() });
-    case "logout": {
-      const profile = str2(flags["profile"]);
-      const endpoint = str2(flags["endpoint"]) ?? process.env["GIT_PUBLISHER_ENDPOINT"];
-      if (!profile && !endpoint) {
-        throw new PublisherError("INVALID_REQUEST", "logout requires --endpoint or --profile");
-      }
-      const { revoked } = profile ? await removeProfile(profile, { revoke: true }) : await removeCredential(endpoint, { revoke: true });
-      out({ ok: true, ...profile ? { profile } : { endpoint }, revoked });
-      return 0;
-    }
-    case "profile": {
-      const file = await readCredentials();
-      const list = () => {
-        const s = credentialStatus({ file, env: process.env });
-        return { profiles: s.profiles, defaultProfile: s.defaultProfile, credentialsFile: credentialsPath() };
-      };
-      switch (cmd[1]) {
-        case void 0:
-        case "list":
-          out(list());
-          return 0;
-        case "use": {
-          const name = cmd[2];
-          if (!name) {
-            throw new PublisherError("INVALID_REQUEST", "profile use requires a name");
-          }
-          await setDefaultProfile(name);
-          out({ ok: true, defaultProfile: name, endpoint: file.profiles[name].endpoint });
-          return 0;
-        }
-        case "remove": {
-          const name = cmd[2];
-          if (!name) {
-            throw new PublisherError("INVALID_REQUEST", "profile remove requires a name");
-          }
-          await removeProfile(name);
-          out({ ok: true, removed: name });
-          return 0;
-        }
-        default:
-          throw new PublisherError("INVALID_REQUEST", `unknown profile command: ${cmd[1]}; expected list, use or remove`);
-      }
-    }
-    case "init": {
-      const dir = dirArg(1);
-      const { p, endpoint } = await client();
-      const repo = str2(flags["repo"]);
-      const linked = await linkFolder(p, endpoint, dir, repo ? { repoId: repo } : {});
-      out({ ok: true, ...linked, endpoint, dir });
-      return 0;
-    }
-    case "publish": {
-      let finishPublish2 = function(o) {
-        out({
-          state: o.state,
-          publicationId: o.publicationId,
-          repoId: o.repoId,
-          generation: o.resultGeneration,
-          refs: o.refs,
-          rejection: o.rejection,
-          resumed: o.resumed,
-          ...o.next === null ? {} : { next: o.next }
-        });
-        return o.state === "accepted" ? 0 : o.state === "rejected" ? 2 : 3;
-      };
-      var finishPublish = finishPublish2;
-      const dir = dirArg(1);
-      const { p } = await client(dir);
-      const refs = Array.isArray(flags["ref"]) ? flags["ref"] : [];
-      const force = flags["force"] === true;
-      const updates = refs.length ? refs.map((r) => ({ ref: r.startsWith("refs/") ? r : `refs/heads/${r}`, force })) : void 0;
-      if (!updates && force) {
-        const b = await currentBranch(dir);
-        if (!b) {
-          throw new PublisherError("LOCAL_STATE", "detached HEAD");
-        }
-        return finishPublish2(await p.publish({ repoDir: dir, updates: [{ ref: b, force: true }], wait: flags["no-wait"] !== true }, { onProgress: progress }));
-      }
-      return finishPublish2(await p.publish({ repoDir: dir, ...updates ? { updates } : {}, wait: flags["no-wait"] !== true }, { onProgress: progress }));
-    }
-    case "status": {
-      const dir = dirArg(1);
-      const { p } = await client(dir);
-      const pubId = str2(flags["publication"]);
-      if (pubId) {
-        const a = await readAssociation(dir);
-        const repoId = str2(flags["repo"]) ?? a?.repoId;
-        if (!repoId) {
-          throw new PublisherError("LOCAL_STATE", "no repository association; pass --repo");
-        }
-        const s = await p.getPublicationStatus(repoId, pubId);
-        out(s);
-        return s.state === "accepted" ? 0 : s.state === "rejected" ? 2 : 3;
-      }
-      const pending = await p.pendingPublications(dir);
-      if (pending.length === 0) {
-        out({ pending: [], resolved: [] });
-        return 0;
-      }
-      const resolved = await p.resumePublications(dir, { onProgress: progress });
-      out({
-        pending: pending.map((x) => x.publicationId),
-        resolved: resolved.map((o) => ({
-          publicationId: o.publicationId,
-          state: o.state,
-          generation: o.resultGeneration,
-          rejection: o.rejection,
-          ...o.next === null ? {} : { next: o.next }
-        }))
-      });
-      return resolved.every((o) => o.state === "accepted") ? 0 : resolved.some((o) => o.state === "rejected") ? 2 : 3;
-    }
-    case "fetch": {
-      const dir = dirArg(1);
-      const { p } = await client(dir);
-      const r = await p.fetch({ repoDir: dir }, { onProgress: progress });
-      out({ ok: true, repoId: r.repoId, generation: r.generation, remote: r.remote, refs: r.refs, tracking: r.tracking, bytes: r.bytes });
-      return 0;
-    }
-    case "list":
-      out(await listApps((await client()).p, { archived: flags["archived"] === true, cursor: str2(flags["cursor"]) }));
-      return 0;
-    case "checkout": {
-      const dir = dirArg(1);
-      const repoId = str2(flags["repo"]);
-      if (!repoId) {
-        throw new PublisherError("INVALID_REQUEST", "checkout requires --repo <id>");
-      }
-      const { p } = await client();
-      const branch = str2(flags["branch"]);
-      const m = await p.checkout({ directory: dir, repoId, ...branch ? { branch } : {} }, { onProgress: progress });
-      out({ ok: true, workspace: m });
-      return 0;
-    }
-    case "workspace-status": {
-      const dir = dirArg(1);
-      const { p } = await client(dir);
-      const s = await p.workspaceStatus(dir, { onProgress: progress });
-      out(s);
-      return s.state === "conflict" ? 2 : 0;
-    }
-    /**
-     * The creator's one verb: record the folder's changes, bring in what the service has, publish.
-     * `--apply` is still accepted, so a `sync --apply` written down anywhere does the whole round
-     * trip rather than failing.
-     */
-    case "sync": {
-      const dir = dirArg(1);
-      const timeoutMs = followTimeoutMs(str2(flags["timeout"]));
-      const clock = stopwatch();
-      const { p, endpoint, source } = await client(dir);
-      clock.lap("discovery");
-      await resolveToken(endpoint, str2(flags["token"]), { endpointSource: source });
-      clock.lap("authentication");
-      const linked = await isGitRepo(dir) && await readAssociation(dir) !== null ? null : await linkFolder(p, endpoint, dir, {});
-      clock.lap("link", linked !== null);
-      const sending = splitAtBegin(clock, progress);
-      const r = await p.syncChanges({ directory: dir, markConflicts: flags["mark-conflicts"] === true, ...optStr(flags, "message") }, { onProgress: sending.onProgress });
-      const acceptedAt = sending.done();
-      const o = r.published;
-      const followed = o !== null && o.state === "accepted" && flags["no-wait"] !== true ? await followPublication(p, endpoint, o, { ...following, timeoutMs, dir }) : null;
-      const syncTimings = clock.read(followed !== null && "stages" in followed ? runTimings(followed.stages, acceptedAt) : {});
-      log(timingsLine(syncTimings));
-      out({
-        ok: r.state === "published" || r.state === "up_to_date",
-        state: r.state,
-        linked: linked === null ? null : { repoId: linked.repoId, appId: linked.appId, created: linked.created },
-        recorded: r.recorded,
-        merged: r.reconciled.applied,
-        conflicts: r.reconciled.before.conflicts,
-        marked: r.marked,
-        publication: o === null ? null : {
-          state: o.state,
-          publicationId: o.publicationId,
-          generation: o.resultGeneration,
-          refs: o.refs,
-          rejection: o.rejection,
-          ...o.next === null ? {} : { next: o.next }
-        },
-        hint: syncHint(r.state, r.reconciled.before.conflicts, r.marked),
-        progress: followed,
-        timings: syncTimings
-      });
-      return r.state === "published" || r.state === "up_to_date" ? 0 : r.state === "unknown" ? 3 : 2;
-    }
-    /**
-     * Pick up following a run where a bounded `sync --timeout` (or an interrupted one) left it. The
-     * ref and commit come from git-publisher's own record of the publication, so the command needs
-     * only its id. Each call reports the stages as they now stand, from the first.
-     */
-    case "follow": {
-      const dir = dirArg(1);
-      const publicationId = str2(flags["publication"]);
-      if (!publicationId) {
-        throw new PublisherError("INVALID_REQUEST", "follow requires --publication <id>");
-      }
-      const timeoutMs = followTimeoutMs(str2(flags["timeout"]));
-      const { p, endpoint } = await client(dir);
-      const repoId = str2(flags["repo"]) ?? (await readAssociation(dir))?.repoId;
-      if (!repoId) {
-        throw new PublisherError("LOCAL_STATE", "no repository association; pass --repo");
-      }
-      const publication = await p.getPublicationStatus(repoId, publicationId);
-      if (publication.state !== "accepted") {
-        throw new PublisherError("LOCAL_STATE", `publication ${publicationId} is ${publication.state}, not accepted; run publisher status`);
-      }
-      const clock = stopwatch();
-      const followed = await followPublication(p, endpoint, publication, { ...following, timeoutMs, dir });
-      const timings = clock.read("stages" in followed ? runTimings(followed.stages, null) : {});
-      log(timingsLine(timings));
-      out({ publicationId, progress: followed, timings });
-      return 0;
-    }
-    /**
-     * The business question the app's current preparation waits on, from this folder's repository.
-     * Exit 0 whether or not one is pending: `questions` says which. An outage is exit 3, never "none".
-     */
-    case "question": {
-      const dir = dirArg(1);
-      const { p, endpoint } = await client(dir);
-      const repoId = str2(flags["repo"]) ?? (await readAssociation(dir))?.repoId;
-      if (!repoId) {
-        throw new PublisherError("LOCAL_STATE", "no repository association; pass --repo");
-      }
-      out({ repoId, ...await questionAt(p, endpoint, repoId) });
-      return 0;
-    }
-    /** Answer it, as `question=value` pairs, re-reading the preparation first. */
-    case "answer": {
-      const dir = (0, import_node_path9.resolve)(".");
-      const { p, endpoint } = await client(dir);
-      const repoId = str2(flags["repo"]) ?? (await readAssociation(dir))?.repoId;
-      if (!repoId) {
-        throw new PublisherError("LOCAL_STATE", "no repository association; pass --repo");
-      }
-      out({ repoId, ...await answerAt(p, endpoint, repoId, cmd.slice(1)) });
-      return 0;
-    }
-    case "skills": {
-      if (cmd[1] !== "install") {
-        throw new PublisherError("INVALID_REQUEST", `unknown skills command: ${cmd[1] ?? "(none)"}; expected install`);
-      }
-      const r = await installSkills({ log });
-      out(r);
-      return 0;
-    }
-    case "merge-check": {
-      const dir = dirArg(1);
-      const ours = str2(flags["ours"]);
-      const theirs = str2(flags["theirs"]);
-      if (!ours || !theirs) {
-        throw new PublisherError("INVALID_REQUEST", "merge-check requires --ours and --theirs");
-      }
-      const r = await mergeRemote({
-        repoDir: dir,
-        ours: ours.startsWith("refs/") ? ours : `refs/heads/${ours}`,
-        theirs,
-        apply: flags["apply"] === true,
-        ...optStr(flags, "message")
-      });
-      out(r);
-      return r.ok ? 0 : 2;
-    }
-    case "info": {
-      const dir = dirArg(1);
-      const { p } = await client(dir);
-      const a = await readAssociation(dir);
-      const repoId = str2(flags["repo"]) ?? a?.repoId;
-      if (!repoId) {
-        throw new PublisherError("LOCAL_STATE", "no repository association; pass --repo");
-      }
-      out(await p.getRepository(repoId));
-      return 0;
-    }
-    default:
-      process.stderr.write(`unknown command: ${cmd[0]}
-${USAGE}`);
-      return 1;
-  }
-}
-var GIT_COMMANDS = /* @__PURE__ */ new Set(["init", "publish", "status", "fetch", "checkout", "workspace-status", "sync", "merge-check"]);
-async function demand(r, input) {
-  if (r.kind === "resolved") {
-    return r;
-  }
-  const next = nextStep(credentialStatus(input));
-  const details = { profiles: r.kind === "none" ? [] : r.profiles, next };
-  const run = next.command === null ? "" : ` Run: ${next.command}`;
-  switch (r.kind) {
-    case "unknown-profile":
-      throw new PublisherError("LOCAL_STATE", `no such profile: ${r.name}.${run}`, { details });
-    case "ambiguous":
-      throw new PublisherError("LOCAL_STATE", `several connections and none is the default: pass --profile <name>, or choose one once.${run}`, { details });
-    case "none": {
-      const where = await whereCredentialsWere();
-      throw new PublisherError("LOCAL_STATE", `not connected to a publishing service yet: ${where.sentence}${run}`, { details: { ...details, credentialsFile: where.details } });
-    }
+  if (help || name === void 0 || name === "help") {
+    process.stdout.write(USAGE);
+    return 0;
   }
-}
-function syncHint(state, conflicts, marked) {
-  switch (state) {
-    case "published":
-      return "Your changes are saved and published.";
-    case "up_to_date":
-      return "Nothing new to publish: the service already has this version.";
-    case "conflict":
-      return marked ? `Both versions are now in ${conflicts.join(", ")}, between <<<<<<< and >>>>>>> lines. Edit each to what should be kept, remove those lines, then run publisher sync.` : `Your changes and the published version both changed ${conflicts.join(", ")}. Nothing was published and nothing was lost; decide which version to keep.`;
-    case "rejected":
-      return "The service refused the publication; see publication.rejection.";
-    default:
-      return "The publication was sent but its outcome is not known yet; run publisher status.";
+  if (command === void 0) {
+    process.stderr.write(`unknown command: ${name}
+${USAGE}`);
+    return 1;
   }
-}
-function formatHuman(v) {
-  return JSON.stringify(v, null, 2);
+  return command.run(inv);
 }
 for (const sig of ["SIGINT", "SIGTERM"]) {
   process.once(sig, () => {