@next-friday/create-app 9.1.1 → 9.2.0

package/README.md

@@ -29,7 +29,7 @@ Every stack is built from [`templates/base`](templates/base), which holds the sh
 ## What every project includes
 
 - **Code quality:** TypeScript, ESLint and Prettier with the Next Friday configs, Vitest with coverage, fast-check, Knip, dependency-cruiser, editorconfig-checker, and sort-package-json.
-- **Git hooks:** Husky runs gitleaks and lint-staged before each commit, commitlint on each message, and `pnpm check` before each push. Commits and pushes to `main` are blocked after the first one.
+- **Git hooks:** Husky runs gitleaks, `pnpm rules:check`, and lint-staged before each commit, commitlint on each message, and `pnpm check` before each push. After the first commit, commits to `main` are blocked, and local merges into `main` always are; pushes to `main` are blocked once it exists on the remote.
 - **CI:** GitHub Actions run the static checks, tests with patch coverage, the build, end-to-end tests for Next.js and Payload, a container build and vulnerability scan, Semgrep, OSV-Scanner, CodeQL, dependency review, OpenSSF Scorecard, gitleaks, TruffleHog, zizmor, and pull request title validation. Dependabot keeps dependencies current.
 - **Deployment:** a `Dockerfile` that runs as the `node` user, and a Railway workflow that promotes one commit through `dev`, `uat`, and `prod`.
 - **Agent rules:** `CLAUDE.md` imports `AGENTS.md`. Shared rules live in `.agents/rules`, with hooks that enforce them in Claude Code and Cursor, and a Cursor Bugbot configuration.
@@ -37,9 +37,9 @@ Every stack is built from [`templates/base`](templates/base), which holds the sh
 ## Requirements
 
 - Node.js 24.22.1, the version in the generated `.nvmrc`. The CLI itself runs on the range in [`package.json#engines`](package.json).
-- pnpm: `npm install --global pnpm`. The generated project pins its pnpm version in `package.json#packageManager`.
+- pnpm, through Corepack: `corepack enable`. The generated project pins its pnpm version in `package.json#packageManager`.
 - Git 2.28 or later.
-- gitleaks 8.19 or later and jq, which the generated project's Git hooks need for the first commit.
+- gitleaks 8.21 or later and jq, which the generated project's Git hooks need for the first commit.
 
 ## Options
 
@@ -60,6 +60,7 @@ The name must:
 
 - use lowercase letters, digits, `.`, `_`, or `-`, and start with a letter or digit;
 - not end in `.`, and not be `node_modules`, `favicon.ico`, or a name that Windows reserves, such as `con`;
+- be at most 214 characters long;
 - point to a directory that does not exist or is empty, apart from `.git`.
 
 ## What the CLI does
@@ -84,7 +85,7 @@ Then follow **After creating a project from this template** in the project's `RE
 - **`pnpm install` fails:** the CLI keeps the project and exits with 1. Fix the printed error, such as a Node.js version outside the project's `package.json#engines`, then run `pnpm install` in the project.
 - **`--skip-git`:** run `git init --initial-branch=main` before `pnpm install`, so the install can set up the Git hooks.
 - **`--skip-install`:** the Git hooks are not set up until you run `pnpm install`.
-- **Cancelling:** Ctrl+C exits with 130. During the copy, it also removes the partly copied project.
+- **Cancelling:** Ctrl+C, SIGTERM, and SIGHUP exit with 130. During the copy, they also remove the partly copied project.
 - **Payload:** set `DATABASE_URL` in `.env` to a PostgreSQL database before you start the app.
 
 ## Contributing

package/dist/main.mjs

@@ -1,68 +1,12 @@
 #!/usr/bin/env node
 import { cancel, intro, isCancel, log, outro, select, text } from "@clack/prompts";
 import { chmod, cp, readFile, readdir, rename, writeFile } from "node:fs/promises";
-import { existsSync, lstatSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, rmSync, statSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
 import { randomBytes } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { parseArgs } from "node:util";
-// src/stacks.ts
-const stacks = [
-	{
-		id: "nodejs",
-		label: "Node.js",
-		hint: "HTTP service without a framework",
-		requiresDatabase: false
-	},
-	{
-		id: "nestjs",
-		label: "NestJS",
-		hint: "HTTP API",
-		requiresDatabase: false
-	},
-	{
-		id: "nextjs",
-		label: "Next.js",
-		hint: "Web app",
-		requiresDatabase: false
-	},
-	{
-		id: "payload",
-		label: "Payload",
-		hint: "Headless CMS on Next.js and PostgreSQL",
-		requiresDatabase: true
-	},
-	{
-		id: "turborepo",
-		label: "Turborepo",
-		hint: "Next.js app and Payload backoffice",
-		requiresDatabase: true
-	}
-];
-const developmentScripts = {
-	nodejs: "start:dev",
-	nestjs: "start:dev",
-	nextjs: "dev",
-	payload: "dev",
-	turborepo: "dev"
-};
-/**
-* Check whether a string names a supported stack.
-* @param value - Stack name from the command line.
-* @returns Whether `value` is a supported stack id.
-*/
-function isStackId(value) {
-	return stacks.some((stack) => stack.id === value);
-}
-/**
-* Name the package a stack's template declares, which the CLI replaces with the project name.
-* @param stack - Supported stack id.
-* @returns Package name in the template's `package.json`.
-*/
-function templateName(stack) {
-	return `next-friday-template-${stack}`;
-}
 // src/setup.ts
 /**
 * Write `.env` from `.env.example`, replacing the `PAYLOAD_SECRET` placeholder with a random secret.
@@ -90,7 +34,11 @@ function initGit(directory) {
 	return spawnSync("git", ["init", "--initial-branch=main"], {
 		cwd: directory,
 		env: environment,
-		stdio: "ignore"
+		stdio: [
+			"ignore",
+			"ignore",
+			"inherit"
+		]
 	}).status === 0 ? "initialized" : "failed";
 }
 /**
@@ -118,6 +66,18 @@ function projectGitEnvironment() {
 	localVariables.delete("GIT_CONFIG_COUNT");
 	return Object.fromEntries(Object.entries(process.env).filter(([name]) => !localVariables.has(name)));
 }
+// src/project-files.ts
+/**
+* List the files of a project directory, leaving out a Git repository the directory already held.
+* @param directory - Project directory.
+* @returns Absolute paths of the files.
+*/
+async function listProjectFiles(directory) {
+	return (await readdir(directory, {
+		recursive: true,
+		withFileTypes: true
+	})).filter((entry) => entry.isFile()).map((entry) => path.join(entry.parentPath, entry.name)).filter((file) => path.relative(directory, file).split(path.sep)[0] !== ".git");
+}
 // src/project-name.ts
 const packageNamePattern = /^[a-z0-9][a-z0-9._-]*$/;
 const maxPackageNameLength = 214;
@@ -146,7 +106,7 @@ function validateProjectName(name, cwd) {
 	const target = path.resolve(cwd, name);
 	const stats = lstatSync(target, { throwIfNoEntry: false });
 	if (stats === void 0) return;
-	if (!stats.isDirectory()) return `${target} already exists and is not a directory.`;
+	if (!(stats.isSymbolicLink() ? statSync(target, { throwIfNoEntry: false }) : stats)?.isDirectory()) return `${target} already exists and is not a directory.`;
 	return ownEntries(target).length > 0 ? `${target} already exists and is not empty.` : void 0;
 }
 /**
@@ -157,8 +117,63 @@ function validateProjectName(name, cwd) {
 function ownEntries(directory) {
 	return readdirSync(directory).filter((entry) => entry !== ".git");
 }
+// src/stacks.ts
+const stacks = [
+	{
+		id: "nodejs",
+		label: "Node.js",
+		hint: "HTTP service without a framework",
+		developmentScript: "start:dev",
+		requiresDatabase: false
+	},
+	{
+		id: "nestjs",
+		label: "NestJS",
+		hint: "HTTP API",
+		developmentScript: "start:dev",
+		requiresDatabase: false
+	},
+	{
+		id: "nextjs",
+		label: "Next.js",
+		hint: "Web app",
+		developmentScript: "dev",
+		requiresDatabase: false
+	},
+	{
+		id: "payload",
+		label: "Payload",
+		hint: "Headless CMS on Next.js and PostgreSQL",
+		developmentScript: "dev",
+		requiresDatabase: true
+	},
+	{
+		id: "turborepo",
+		label: "Turborepo",
+		hint: "Next.js app and Payload backoffice",
+		developmentScript: "dev",
+		requiresDatabase: true
+	}
+];
+const stackById = Object.fromEntries(stacks.map((stack) => [stack.id, stack]));
+/**
+* Check whether a string names a supported stack.
+* @param value - Stack name from the command line.
+* @returns Whether `value` is a supported stack id.
+*/
+function isStackId(value) {
+	return stacks.some((stack) => stack.id === value);
+}
+/**
+* Name the package a stack's template declares, which the CLI replaces with the project name.
+* @param stack - Supported stack id.
+* @returns Package name in the template's `package.json`.
+*/
+function templateName(stack) {
+	return `next-friday-template-${stack}`;
+}
 // src/arguments.ts
-const usage = `Usage: pnpm create @next-friday/app [name] [--stack nodejs|nestjs|nextjs|payload|turborepo]
+const usage = `Usage: pnpm create @next-friday/app [name] [--stack ${stacks.map((stack) => stack.id).join("|")}]
 
   name            Project directory and package name, or . for the current directory. Asked when left out.
   --stack         Template stack. Asked when left out.
@@ -197,18 +212,19 @@ function parseCliArguments(cliArguments) {
 			}
 		}
 	});
-	if (positionals.length > 1) throw new Error(`Pass one project name, not ${positionals.length}: ${positionals.join(" ")}.`);
-	const [name] = positionals;
 	const { help, stack, version } = values;
-	if (stack !== void 0 && !isStackId(stack)) {
+	const isInformational = help || version;
+	if (!isInformational && positionals.length > 1) throw new Error(`Pass one project name, not ${positionals.length}: ${positionals.join(" ")}.`);
+	const [name] = positionals;
+	if (!isInformational && stack !== void 0 && !isStackId(stack)) {
 		const ids = stacks.map((supported) => supported.id).join(", ");
 		throw new Error(`Unknown stack "${stack}". Use one of: ${ids}.`);
 	}
 	return {
 		help,
 		name,
-		stack,
 		version,
+		stack: stack !== void 0 && isStackId(stack) ? stack : void 0,
 		skipGit: values["skip-git"],
 		skipInstall: values["skip-install"]
 	};
@@ -219,23 +235,23 @@ function parseCliArguments(cliArguments) {
 * @param directory - Project directory.
 * @param from - Template name to replace.
 * @param to - Project name.
-* @returns Paths of the files that changed.
 */
 async function renameProject(directory, from, to) {
-	const files = (await readdir(directory, {
-		recursive: true,
-		withFileTypes: true
-	})).filter((entry) => entry.isFile()).map((entry) => path.join(entry.parentPath, entry.name));
-	return (await Promise.all(files.map(async (file) => {
+	const files = await listProjectFiles(directory);
+	await Promise.all(files.map(async (file) => {
 		const content = await readFile(file);
 		const text = content.toString("utf8");
-		if (content.includes(0) || !content.includes(from) || !Buffer.from(text, "utf8").equals(content)) return [];
+		if (content.includes(0) || !content.includes(from) || !Buffer.from(text, "utf8").equals(content)) return;
 		await writeFile(file, text.replaceAll(from, () => to));
-		return [file];
-	}))).flat();
+	}));
 }
 // src/create.ts
 const templatesDirectory = fileURLToPath(new URL("../templates", import.meta.url));
+const interruptSignals = [
+	"SIGINT",
+	"SIGTERM",
+	"SIGHUP"
+];
 var CancelledError = class extends Error {
 	message = "Cancelled.";
 };
@@ -244,8 +260,8 @@ var CancelledError = class extends Error {
 * @param cliArguments - Arguments after the executable and script path.
 */
 async function create(cliArguments) {
-	const cwd = process.cwd();
 	try {
+		const cwd = process.cwd();
 		const options = parseCliArguments(cliArguments);
 		if (options.help) {
 			process.stdout.write(`${usage}\n`);
@@ -255,23 +271,28 @@ async function create(cliArguments) {
 			process.stdout.write(`${packageVersion()}\n`);
 			return;
 		}
-		intro("Create a Next Friday project");
 		const { name, stack } = await resolveProject(options, cwd);
 		const manifestName = packageName(name, cwd);
-		const directory = path.resolve(cwd, name);
+		const target = path.resolve(cwd, name);
+		const directory = existsSync(target) ? realpathSync(target) : target;
 		log.step(`Copying the ${stack} template.`);
 		await writeProject(stack, directory, manifestName);
 		log.success(`Created ${manifestName} from the ${stack} template.`);
 		const { git, isInstalled } = setUpProject(directory, options);
 		outro(nextSteps(name, stack, git, isInstalled));
 	} catch (error) {
-		cancel(error instanceof Error ? error.message : String(error));
-		process.exitCode = error instanceof CancelledError ? 130 : 1;
+		if (error instanceof CancelledError) {
+			cancel(error.message);
+			process.exitCode = 130;
+		} else {
+			process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+			process.exitCode = 1;
+		}
 	}
 }
 /**
-* Copy, rename, and write `.env`, removing what was written when a step fails or Ctrl+C arrives.
-* Ctrl+C waits for the running step, so the removal does not race the copy.
+* Copy, rename, and write `.env`, removing what was written when a step fails or Ctrl+C, SIGTERM, or SIGHUP arrives.
+* An interrupt waits for the running step, so the removal does not race the copy.
 * @param stack - Supported stack id.
 * @param directory - Project directory.
 * @param manifestName - Package name for `package.json`.
@@ -282,7 +303,7 @@ async function writeProject(stack, directory, manifestName) {
 	const interrupt = () => {
 		isInterrupted = true;
 	};
-	process.on("SIGINT", interrupt);
+	for (const signal of interruptSignals) process.on(signal, interrupt);
 	try {
 		await copyTemplate(stack, directory);
 		await renameProject(directory, templateName(stack), manifestName);
@@ -292,7 +313,7 @@ async function writeProject(stack, directory, manifestName) {
 		removeProject(directory, kept);
 		throw isInterrupted ? new CancelledError() : error;
 	} finally {
-		process.off("SIGINT", interrupt);
+		for (const signal of interruptSignals) process.off(signal, interrupt);
 	}
 }
 /**
@@ -303,16 +324,28 @@ async function writeProject(stack, directory, manifestName) {
 */
 async function resolveProject(options, cwd) {
 	if (!process.stdin.isTTY && (options.name === void 0 || options.stack === void 0)) throw new Error(`Pass the project name and --stack when not running in a terminal.\n${usage}`);
+	if (options.name !== void 0) assertUsableName(options.name, cwd);
+	intro("Create a Next Friday project");
 	const name = options.name ?? await askName(cwd);
-	const nameError = validateProjectName(name, cwd);
-	if (nameError !== void 0) throw new Error(nameError);
+	const stack = options.stack ?? await askStack();
+	assertUsableName(name, cwd);
 	return {
 		name,
-		stack: options.stack ?? await askStack()
+		stack
 	};
 }
+/**
+* Throw when the project name is unusable or its directory is taken, as a prompt may have left a
+* directory in place since the name was checked.
+* @param name - Project name, or `.` for the current directory.
+* @param cwd - Directory the project is created in.
+*/
+function assertUsableName(name, cwd) {
+	const nameError = validateProjectName(name, cwd);
+	if (nameError !== void 0) throw new Error(nameError);
+}
 const gitWarnings = {
-	failed: "git init failed. Install Git 2.28 or later, then run the steps below.",
+	failed: "git init failed. Check that Git 2.28 or later is installed and the directory is writable, then run the steps below.",
 	parent: "Skipped git init inside an existing Git repository. The Git hooks install only at a repository root."
 };
 /**
@@ -322,7 +355,7 @@ const gitWarnings = {
 * @returns The `git init` result, or `undefined` when skipped, and whether the install succeeded.
 */
 function setUpProject(directory, options) {
-	const git = options.skipGit ? void 0 : initGit(directory);
+	const git = options.skipGit ? existingGit(directory) : initGit(directory);
 	const warning = git === void 0 ? void 0 : gitWarnings[git];
 	if (warning !== void 0) log.warn(warning);
 	if (options.skipInstall) return {
@@ -332,7 +365,7 @@ function setUpProject(directory, options) {
 	log.step("Installing dependencies with pnpm.");
 	const isInstalled = didInstallDependencies(directory);
 	if (!isInstalled) {
-		log.error("pnpm install failed. Fix the error above, then run the steps below. The project needs pnpm and the Node.js version in .nvmrc.");
+		log.error("pnpm install failed. Fix the error above, then run the steps below. The project needs pnpm and the Node.js version in package.json#engines.");
 		process.exitCode = 1;
 	}
 	return {
@@ -341,12 +374,21 @@ function setUpProject(directory, options) {
 	};
 }
 /**
+* Report a repository that skipping `git init` leaves in place.
+* @param directory - Project directory.
+* @returns `existing` when the directory holds `.git`, otherwise `undefined`.
+*/
+function existingGit(directory) {
+	return existsSync(path.join(directory, ".git")) ? "existing" : void 0;
+}
+/**
 * Copy the shared template files, then the stack's files, into the project directory.
 * npm leaves `.gitignore` out of published packages, so the template keeps it as `_gitignore`.
 * @param stack - Supported stack id.
 * @param directory - Project directory.
 */
 async function copyTemplate(stack, directory) {
+	for (const template of ["base", stack]) if (!existsSync(path.join(templatesDirectory, template))) throw new Error(`The ${template} template is missing from ${templatesDirectory}. Reinstall @next-friday/create-app.`);
 	await cp(path.join(templatesDirectory, "base"), directory, { recursive: true });
 	await cp(path.join(templatesDirectory, stack), directory, { recursive: true });
 	await rename(path.join(directory, "_gitignore"), path.join(directory, ".gitignore"));
@@ -358,12 +400,8 @@ async function copyTemplate(stack, directory) {
 * @param directory - Project directory.
 */
 async function markScriptsExecutable(directory) {
-	const entries = await readdir(directory, {
-		recursive: true,
-		withFileTypes: true
-	});
-	await Promise.all(entries.filter((entry) => entry.isFile()).map(async (entry) => {
-		const file = path.join(entry.parentPath, entry.name);
+	const files = await listProjectFiles(directory);
+	await Promise.all(files.map(async (file) => {
 		if ((await readFile(file)).subarray(0, 2).toString() === "#!") await chmod(file, 493);
 	}));
 }
@@ -388,14 +426,15 @@ function removeProject(directory, kept) {
 * @returns The next steps message.
 */
 function nextSteps(name, stack, git, isInstalled) {
+	const { developmentScript, requiresDatabase } = stackById[stack];
 	const hasGit = git !== void 0 && git !== "failed";
 	const commands = [
 		name === "." ? [] : [`cd ${name}`],
 		hasGit ? [] : ["git init --initial-branch=main"],
 		hasGit && isInstalled ? [] : ["pnpm install"],
-		[`pnpm ${developmentScripts[stack]}`]
+		[`pnpm ${developmentScript}`]
 	].flat();
-	const database = stacks.find((item) => item.id === stack)?.requiresDatabase ? `Set DATABASE_URL in .env to your PostgreSQL database before pnpm ${developmentScripts[stack]}.\n` : "";
+	const database = requiresDatabase ? `Set DATABASE_URL in .env to your PostgreSQL database before pnpm ${developmentScript}.\n` : "";
 	const readme = name === "." ? "README.md" : `${name}/README.md`;
 	return `Next steps:\n${commands.map((command) => `  ${command}`).join("\n")}\n${database}Before the first commit, follow "After creating a project from this template" in ${readme}.`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next-friday/create-app",
-  "version": "9.1.1",
+  "version": "9.2.0",
   "description": "Create a Next Friday project from a template.",
   "keywords": [
     "create",
@@ -54,7 +54,8 @@
     "sort-package-json": "4.1.0",
     "tsdown": "0.23.4",
     "typescript": "6.0.3",
-    "vitest": "5.0.5"
+    "vitest": "5.0.5",
+    "yaml": "2.9.1"
   },
   "engines": {
     "node": ">=24.15.0"
@@ -65,6 +66,7 @@
   },
   "scripts": {
     "audit": "pnpm audit",
+    "bands:check": "node scripts/check-bands.ts",
     "build": "tsdown",
     "changeset": "changeset",
     "changeset:status": "changeset status --since main",
@@ -72,24 +74,23 @@
     "check:publint": "publint",
     "clean": "rm -rf dist coverage *.tsbuildinfo .eslintcache node_modules/.cache",
     "dev": "tsdown --watch",
+    "evals:run": "node scripts/run-agent-evals.ts",
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
     "gates:check": "node scripts/check-agent-gates.ts",
-    "human-gates:check": "node scripts/check-human-gates.ts",
-    "intent:check": "node scripts/check-intent.ts",
     "knip": "knip",
     "lint": "eslint . --fix --cache --max-warnings=0 --no-inline-config",
     "lint:check": "eslint . --cache --max-warnings=0 --no-inline-config",
     "loop:measure": "node scripts/measure-loop.ts",
+    "plan:check": "node scripts/check-plan.ts",
     "rules:check": "node scripts/sync-agent-rules.ts --check",
     "rules:sync": "node scripts/sync-agent-rules.ts",
     "sort-package-json": "sort-package-json package.json",
     "sort-package-json:check": "sort-package-json --check package.json",
-    "suppressions:check": "bash .agents/hooks/agent-suppression-gate.sh --repo",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit -p tsconfig.json",
-    "verify": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm human-gates:check && pnpm intent:check && pnpm changesets:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm typecheck && pnpm test:coverage && pnpm knip && pnpm build && pnpm check:publint"
+    "verify": "pnpm rules:check && pnpm gates:check && pnpm plan:check && pnpm bands:check && pnpm changesets:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm typecheck && pnpm test:coverage && pnpm knip && pnpm build && pnpm check:publint"
   }
 }

package/templates/base/.agents/hooks/agent-mcp-gate.sh

@@ -16,7 +16,12 @@ trap 'block ".agents/hooks/agent-mcp-gate.sh failed. Stop and report this error
 command -v jq > /dev/null || block "jq is required to read the hook input. Install it: https://jqlang.org/download/"
 input=$(cat)
 tool=$(jq -r '.tool_name // empty' <<< "$input")
-if [[ $tool =~ (merge_pull_request|enable_pr_auto_merge|pull_request_review_write)$ ]]; then
-  block "A code owner approves a pull request and a person merges it. Do not approve or merge; report that the pull request waits on that review."
+human_gate="A code owner approves a pull request and a person merges it. Do not approve or merge; report that the pull request waits on that review."
+if [[ $tool =~ (merge_pull_request|enable_pr_auto_merge)$ ]]; then
+  block "$human_gate"
+fi
+if [[ $tool =~ pull_request_review_write$ ]]; then
+  event=$(jq -r '(.tool_input | if type == "string" then (fromjson? // {}) else . end | objects | .event) // empty' <<< "$input" | tr '[:upper:]' '[:lower:]')
+  [[ $event == approve ]] && block "$human_gate"
 fi
 allow

package/templates/base/.agents/hooks/agent-production-gate.sh

@@ -15,7 +15,12 @@ block() {
 trap 'block ".agents/hooks/agent-production-gate.sh failed. Stop and report this error to the user; agents may not edit the gate."' ERR
 command -v jq > /dev/null || block "jq is required to read the hook input. Install it: https://jqlang.org/download/"
 command=$(jq -r '.command // .tool_input.command // empty')
-[[ -n $command && -z ${RELEASE_APPROVAL:-} ]] || allow
+[[ -n $command ]] || allow
+approval=$(tr '[:upper:]' '[:lower:]' <<< "${RELEASE_APPROVAL:-}")
+case $approval in
+  "" | 0 | false | no) ;;
+  *) allow ;;
+esac
 
 release_gate="A release manager runs prod deploys, commands against prod, and release tag pushes. Do not run this; report what is ready to promote, such as the commit SHA. If a gated command appears only inside a message, write the text to a file and pass it with git commit -F <file> or gh pr create --body-file <file>."