@orkestrel/scaffold 0.0.76 → 0.0.78

package/dist/agents/skills/orkestrel-publish/scripts/wave.js

@@ -0,0 +1,458 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'node:fs';
+import { basename, dirname, extname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parseJsonRecord, readJsonObject, readMissingFlags, readOption, readString, runNpm, } from "../../orkestrel-dispatch/scripts/helpers.js";
+const STEPS = [
+    'pin',
+    'commit',
+    'overwrite',
+    'verify',
+    'install',
+    'pins',
+    'format',
+    'gates',
+    'compare',
+];
+const GATES = ['format:check', 'lint:check', 'check', 'build', 'test'];
+const RUNTIME_FIELDS = ['dependencies', 'peerDependencies'];
+const RANGE_FIELDS = [...RUNTIME_FIELDS, 'devDependencies'];
+const CATALOG = '.claude/agents/orkestrel.md';
+const OFFLINE_REFUSAL = "'catalog' does not take --offline";
+const VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u;
+// The checkout runs the `.ts` sources and a built twin under `dist/agents` runs `.js` siblings.
+const EXTENSION = extname(fileURLToPath(import.meta.url));
+const COMPARE = fileURLToPath(new URL(`./compare${EXTENSION}`, import.meta.url));
+const PINS = fileURLToPath(new URL(`./pins${EXTENSION}`, import.meta.url));
+function readManifest(target) {
+    try {
+        return parseJsonRecord(readFileSync(join(target, 'package.json'), 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+function readRanges(manifest, fields) {
+    const ranges = new Map();
+    for (const field of fields) {
+        const block = manifest[field];
+        if (typeof block !== 'object' || block === null)
+            continue;
+        for (const [name, range] of Object.entries(block)) {
+            if (typeof range === 'string')
+                ranges.set(`${field} ${name}`, range);
+        }
+    }
+    return ranges;
+}
+function compareRanges(published, final) {
+    const names = [...new Set([...published.keys(), ...final.keys()])].sort();
+    return names.flatMap((name) => {
+        const before = published.get(name);
+        const after = final.get(name);
+        if (before === after)
+            return [];
+        if (before === undefined)
+            return [`${name} ${String(after)} added`];
+        if (after === undefined)
+            return [`${name} ${before} removed`];
+        return [`${name} ${before} -> ${after}`];
+    });
+}
+function resolveScaffold(target) {
+    const installed = join(target, 'node_modules', '@orkestrel', 'scaffold', 'dist', 'bin', 'main.js');
+    if (existsSync(installed))
+        return [process.execPath, installed];
+    const own = join(target, 'dist', 'bin', 'main.js');
+    if (existsSync(own))
+        return [process.execPath, own];
+    return [];
+}
+function readReleases(text) {
+    const releases = readJsonObject(text)?.releases;
+    if (!Array.isArray(releases))
+        return undefined;
+    return releases.flatMap((entry) => {
+        if (typeof entry !== 'object' || entry === null)
+            return [];
+        const record = Object.fromEntries(Object.entries(entry));
+        const name = readString(record, 'name');
+        const range = readString(record, 'range');
+        if (name === undefined || range === undefined)
+            return [];
+        return [{ name, range, latest: readString(record, 'latest') }];
+    });
+}
+function describeCommand(file, args) {
+    return [file === process.execPath ? 'node' : file, ...args].join(' ');
+}
+function describeFailure(result) {
+    if (result.status === 0)
+        return undefined;
+    return result.stderr
+        .trim()
+        .split(/\r\n|\n/)
+        .slice(-3)
+        .join(' | ');
+}
+function runStep(runner, step, file, args, cwd) {
+    const command = describeCommand(file, args);
+    if (runner.dry) {
+        runner.steps.push({ step, command, exit: undefined, durationMs: 0, note: 'dry run' });
+        return undefined;
+    }
+    const started = Date.now();
+    const result = spawnSync(file, args, {
+        cwd,
+        encoding: 'utf8',
+        windowsHide: true,
+        maxBuffer: 64 * 1024 * 1024,
+    });
+    runner.steps.push({
+        step,
+        command,
+        exit: result.status ?? undefined,
+        durationMs: Date.now() - started,
+        note: describeFailure(result),
+    });
+    return result;
+}
+function runNpmStep(runner, step, args) {
+    const command = `npm ${args.join(' ')}`;
+    if (runner.dry) {
+        runner.steps.push({ step, command, exit: undefined, durationMs: 0, note: 'dry run' });
+        return undefined;
+    }
+    const started = Date.now();
+    const result = runNpm(args, runner.target);
+    runner.steps.push({
+        step,
+        command,
+        exit: result.status ?? undefined,
+        durationMs: Date.now() - started,
+        note: describeFailure(result),
+    });
+    return result;
+}
+function recordStep(runner, step, command, note) {
+    runner.steps.push({ step, command, exit: runner.dry ? undefined : 0, durationMs: 0, note });
+}
+function replaceLastStep(runner, exit, note) {
+    const last = runner.steps.pop();
+    if (last !== undefined)
+        runner.steps.push({ ...last, exit, note });
+}
+function failed(runner) {
+    return runner.steps.some((entry) => entry.exit !== undefined &&
+        entry.exit !== 0 &&
+        entry.step !== 'pins' &&
+        entry.step !== 'compare');
+}
+function writeRanges(target, releases) {
+    const manifest = readManifest(target);
+    if (manifest === undefined)
+        return [];
+    const moved = [];
+    for (const field of RANGE_FIELDS) {
+        const block = manifest[field];
+        if (typeof block !== 'object' || block === null)
+            continue;
+        const ranges = Object.fromEntries(Object.entries(block));
+        for (const release of releases) {
+            if (release.latest === undefined || !(release.name in ranges))
+                continue;
+            const caret = `^${release.latest}`;
+            if (ranges[release.name] !== caret) {
+                ranges[release.name] = caret;
+                moved.push(`${release.name} ${String(release.range)} -> ${caret}`);
+            }
+        }
+        manifest[field] = ranges;
+    }
+    if (moved.length > 0)
+        writeFileSync(join(target, 'package.json'), `${JSON.stringify(manifest, null, '\t')}\n`);
+    return moved;
+}
+function runPin(runner, scaffoldFile, scaffoldPrefix, offline) {
+    const audit = runStep(runner, 'pin', scaffoldFile, [...scaffoldPrefix, 'audit', '--json', ...offline], runner.target);
+    if (audit !== undefined) {
+        const releases = readReleases(audit.stdout);
+        if (releases === undefined || (audit.status !== 0 && audit.status !== 1)) {
+            replaceLastStep(runner, audit.status === null || audit.status === 0 ? 2 : audit.status, releases === undefined ? 'the audit printed no releases envelope' : describeFailure(audit));
+            return;
+        }
+        // The audit exits 1 on the drift this step exists to close, so its exit is a reading here.
+        replaceLastStep(runner, 0, `${releases.length} release reading(s)`);
+        const moved = writeRanges(runner.target, releases);
+        recordStep(runner, 'pin', 'rewrite @orkestrel ranges to the registry caret', moved.length === 0 ? 'no range moved' : moved.join(', '));
+    }
+    else {
+        recordStep(runner, 'pin', 'rewrite @orkestrel ranges to the registry caret', 'dry run');
+    }
+    runNpmStep(runner, 'pin', ['install']);
+}
+function runCommit(runner) {
+    const status = runStep(runner, 'commit', 'git', ['status', '--porcelain', '--', 'package.json', 'package-lock.json'], runner.target);
+    if (status === undefined || status.stdout.trim() !== '') {
+        runStep(runner, 'commit', 'git', [
+            'commit',
+            '--only',
+            '-m',
+            'Re-pin the @orkestrel ranges for the release visit',
+            '--',
+            'package.json',
+            'package-lock.json',
+        ], runner.target);
+    }
+    else {
+        recordStep(runner, 'commit', 'git commit', 'manifest and lockfile already committed');
+    }
+}
+function runOverwrite(runner, scaffoldFile, scaffoldPrefix, offline) {
+    const written = runStep(runner, 'overwrite', scaffoldFile, [...scaffoldPrefix, 'overwrite', '--json', ...offline], runner.target);
+    if (runner.offline && written !== undefined && written.status === 1) {
+        const note = readString(readJsonObject(written.stdout) ?? {}, 'note');
+        if (note !== undefined && note.includes(OFFLINE_REFUSAL)) {
+            replaceLastStep(runner, 0, 'offline overwrite skipped the catalog step by design');
+        }
+        else {
+            replaceLastStep(runner, 1, note ?? describeFailure(written));
+        }
+    }
+    if (!failed(runner)) {
+        runStep(runner, 'overwrite', scaffoldFile, [...scaffoldPrefix, 'audit', ...offline], runner.target);
+    }
+}
+function runVerify(runner, scaffoldFile, scaffoldPrefix, offline) {
+    const audit = runStep(runner, 'verify', scaffoldFile, [...scaffoldPrefix, 'audit', '--json', ...offline], runner.target);
+    if (audit === undefined)
+        return;
+    const releases = readReleases(audit.stdout);
+    if (releases === undefined) {
+        replaceLastStep(runner, audit.status === null || audit.status === 0 ? 2 : audit.status, 'the audit printed no releases envelope');
+        return;
+    }
+    const drift = releases.filter((release) => release.latest !== undefined && release.range !== `^${release.latest}`);
+    runner.steps.push({
+        step: 'verify',
+        command: 'compare every declared range with the registry',
+        exit: drift.length === 0 ? 0 : 1,
+        durationMs: 0,
+        note: drift.length === 0
+            ? undefined
+            : drift
+                .map((release) => `${release.name} ${release.range} vs ${String(release.latest)}`)
+                .join(', '),
+    });
+}
+function runPins(runner, before, version) {
+    const after = readRanges(readManifest(runner.target) ?? {}, RANGE_FIELDS);
+    const prior = [...before]
+        .filter(([name, range]) => after.get(name) !== range)
+        .flatMap(([, range]) => ['--range', range]);
+    if (version === undefined) {
+        recordStep(runner, 'pins', basename(PINS), 'no prior version to sweep for; pass --prior');
+        return undefined;
+    }
+    const swept = runStep(runner, 'pins', process.execPath, [PINS, '--version', version, ...prior], runner.target);
+    return swept === undefined
+        ? undefined
+        : swept.stdout.split(/\r\n|\n/).filter((line) => /^\S+:\d+: /u.test(line)).length;
+}
+function runCompare(runner, name) {
+    const compared = runStep(runner, 'compare', process.execPath, [COMPARE, '--json'], runner.target);
+    const distMoved = compared === undefined
+        ? undefined
+        : compared.status === 3
+            ? true
+            : compared.status === 0
+                ? false
+                : undefined;
+    if (name === undefined) {
+        recordStep(runner, 'compare', 'npm view', 'the manifest names no package to read');
+        return { distMoved, rangesMoved: undefined, ranges: undefined, hits: undefined };
+    }
+    const view = runNpmStep(runner, 'compare', ['view', name, '--json']);
+    const published = view === undefined || view.status !== 0 ? undefined : parseJsonRecord(view.stdout);
+    if (published === undefined) {
+        return { distMoved, rangesMoved: undefined, ranges: undefined, hits: undefined };
+    }
+    const ranges = compareRanges(readRanges(published, RUNTIME_FIELDS), readRanges(readManifest(runner.target) ?? {}, RUNTIME_FIELDS));
+    return { distMoved, rangesMoved: ranges.length > 0, ranges, hits: undefined };
+}
+function describeReading(moved, movedWord, sameWord) {
+    return moved === undefined ? 'unanswered' : moved ? movedWord : sameWord;
+}
+function runVisit(argv) {
+    const target = readOption(argv, '--target') ?? process.cwd();
+    if (!existsSync(join(target, 'package.json'))) {
+        console.error(`wave: ${target} carries no package.json`);
+        return undefined;
+    }
+    const scaffold = resolveScaffold(target);
+    if (scaffold.length === 0) {
+        console.error(`wave: no scaffold executable under ${target}; run npm install first`);
+        return undefined;
+    }
+    const [scaffoldFile, ...scaffoldPrefix] = scaffold;
+    if (scaffoldFile === undefined)
+        return undefined;
+    const runner = {
+        target,
+        dry: argv.includes('--dry-run'),
+        offline: argv.includes('--offline'),
+        steps: [],
+    };
+    const from = STEPS.indexOf(readOption(argv, '--from') ?? 'pin');
+    const to = STEPS.indexOf(readOption(argv, '--to') ?? 'compare');
+    const selected = new Set(STEPS.slice(from, to + 1));
+    const manifest = readManifest(target);
+    if (manifest === undefined) {
+        console.error(`wave: ${target} carries an unreadable package.json`);
+        return undefined;
+    }
+    const name = readString(manifest, 'name');
+    const version = readString(manifest, 'version');
+    const before = readRanges(manifest, RANGE_FIELDS);
+    const offline = runner.offline ? ['--offline'] : [];
+    let hits;
+    let ruling = {
+        distMoved: undefined,
+        rangesMoved: undefined,
+        ranges: undefined,
+        hits: undefined,
+    };
+    if (selected.has('pin'))
+        runPin(runner, scaffoldFile, scaffoldPrefix, offline);
+    if (selected.has('commit') && !failed(runner))
+        runCommit(runner);
+    if (selected.has('overwrite') && !failed(runner)) {
+        runOverwrite(runner, scaffoldFile, scaffoldPrefix, offline);
+    }
+    if (selected.has('verify') && !failed(runner)) {
+        runVerify(runner, scaffoldFile, scaffoldPrefix, offline);
+    }
+    if (selected.has('install') && !failed(runner))
+        runNpmStep(runner, 'install', ['install']);
+    if (selected.has('pins') && !failed(runner)) {
+        hits = runPins(runner, before, readOption(argv, '--prior') ?? version);
+    }
+    if (selected.has('format') && !failed(runner))
+        runNpmStep(runner, 'format', ['run', 'format']);
+    if (selected.has('gates') && !failed(runner)) {
+        for (const gate of GATES) {
+            if (failed(runner))
+                break;
+            runNpmStep(runner, 'gates', ['run', gate]);
+        }
+    }
+    if (selected.has('compare') && !failed(runner))
+        ruling = runCompare(runner, name);
+    ruling = { ...ruling, hits };
+    const bump = ruling.distMoved === true || ruling.rangesMoved === true
+        ? 'bump'
+        : ruling.distMoved === undefined || ruling.rangesMoved === undefined
+            ? 'unanswered'
+            : 'no bump';
+    const reading = `dist ${describeReading(ruling.distMoved, 'moved', 'same')}, ranges ${describeReading(ruling.rangesMoved, 'moved', 'same')}${hits === undefined ? '' : `, ${hits} self-pin hit(s)`}`;
+    return {
+        target,
+        name,
+        version,
+        steps: runner.steps,
+        ruling,
+        row: `| ${name ?? target} | ${version ?? '?'} | ${bump} | ${reading} | round |`,
+    };
+}
+function readLayers(catalogPath) {
+    if (!existsSync(catalogPath))
+        return undefined;
+    const text = readFileSync(catalogPath, 'utf8');
+    const start = text.indexOf('<!-- orkestrel:catalog -->');
+    const end = text.indexOf('<!-- /orkestrel:catalog -->');
+    if (start === -1 || end === -1)
+        return undefined;
+    const layers = new Map();
+    for (const line of text.slice(start, end).split(/\r\n|\n/)) {
+        const match = line.match(/^\|\s*`(@orkestrel\/[a-z0-9-]+)`\s*\|\s*`([^`]+)`\s*\|\s*(L\d+)\s*\|/u);
+        if (match?.[1] === undefined || match[3] === undefined)
+            continue;
+        const members = layers.get(match[3]) ?? [];
+        members.push(`${match[1]} ${match[2] ?? ''}`.trim());
+        layers.set(match[3], members);
+    }
+    return new Map([...layers.entries()].sort(([left], [right]) => Number(left.slice(1)) - Number(right.slice(1))));
+}
+function renderVisit(visit) {
+    const lines = visit.steps.map((entry) => `wave: ${entry.step.padEnd(9)} exit=${entry.exit === undefined ? 'dry' : String(entry.exit)} ${String(entry.durationMs).padStart(7)} ms  ${entry.command}${entry.note === undefined ? '' : `  (${entry.note})`}`);
+    lines.push(`wave: ruling dist ${describeReading(visit.ruling.distMoved, 'moved', 'same')}, ranges ${describeReading(visit.ruling.rangesMoved, 'moved', 'same')}${visit.ruling.hits === undefined ? '' : `, ${visit.ruling.hits} self-pin hit(s)`}`);
+    for (const range of visit.ruling.ranges ?? [])
+        lines.push(`wave: range ${range}`);
+    lines.push(visit.row);
+    return `${lines.join('\n')}\n`;
+}
+function main(argv) {
+    const missing = readMissingFlags(argv, [
+        '--target',
+        '--from',
+        '--to',
+        '--prior',
+        '--catalog',
+        '--out',
+    ]);
+    if (missing.length > 0) {
+        console.error(`wave: ${missing.join(', ')} given with no value`);
+        return 64;
+    }
+    if (argv.includes('--plan') && argv.includes('--visit')) {
+        console.error('wave: --plan and --visit are two modes; name one');
+        return 64;
+    }
+    if (argv.includes('--plan')) {
+        const layers = readLayers(readOption(argv, '--catalog') ?? CATALOG);
+        if (layers === undefined) {
+            console.error('wave: no marker-bounded catalog table; run scaffold catalog first');
+            return 2;
+        }
+        if (argv.includes('--json'))
+            console.log(JSON.stringify(Object.fromEntries(layers)));
+        else
+            for (const [layer, members] of layers)
+                console.log(`${layer}\t${members.join(', ')}`);
+        return 0;
+    }
+    if (!argv.includes('--visit')) {
+        console.error('usage: wave.ts --visit [--target DIR] [--offline] [--from STEP] [--to STEP] [--prior VERSION] [--dry-run] [--json] [--out FILE] | --plan [--catalog PATH] [--json]');
+        return 64;
+    }
+    const from = STEPS.indexOf(readOption(argv, '--from') ?? 'pin');
+    const to = STEPS.indexOf(readOption(argv, '--to') ?? 'compare');
+    if (from === -1 || to === -1 || to < from) {
+        console.error(`wave: --from and --to name steps in order from: ${STEPS.join(', ')}`);
+        return 64;
+    }
+    const prior = readOption(argv, '--prior');
+    if (prior !== undefined && !VERSION.test(prior)) {
+        console.error('wave: --prior takes the version the package carried before its bump, MAJOR.MINOR.PATCH');
+        return 64;
+    }
+    const visit = runVisit(argv);
+    if (visit === undefined)
+        return 2;
+    const output = argv.includes('--json') ? `${JSON.stringify(visit)}\n` : renderVisit(visit);
+    const out = readOption(argv, '--out');
+    if (out === undefined)
+        process.stdout.write(output);
+    else {
+        mkdirSync(dirname(out), { recursive: true });
+        writeFileSync(out, output);
+        console.log(`wave: wrote ${out}`);
+    }
+    return visit.steps.some((entry) => entry.exit !== undefined &&
+        entry.exit !== 0 &&
+        entry.step !== 'pins' &&
+        entry.step !== 'compare')
+        ? 1
+        : 0;
+}
+process.exitCode = main(process.argv.slice(2));

package/dist/agents/skills/orkestrel-publish/scripts/window.js

@@ -0,0 +1,188 @@
+// Work the npm authentication window. Run from the checkout root:
+//   node .agents/skills/orkestrel-publish/scripts/window.ts --whoami [--wait SECONDS]
+//   node .agents/skills/orkestrel-publish/scripts/window.ts --login [--wait SECONDS]
+//   node .agents/skills/orkestrel-publish/scripts/window.ts --publish DIR... --otp CODE [--json]
+//   node .agents/skills/orkestrel-publish/scripts/window.ts --confirm NAME@VERSION... [--wait SECONDS]
+// --whoami reads `npm whoami` once, or polls it every 5 seconds until it answers or the wait ends.
+// --login prints the command the operator runs in a real terminal (npm offers its approval only to a
+// TTY, so no child of this script can hold it), then polls `npm whoami` until it answers or the wait
+// ends. --publish re-reads `npm whoami` immediately before the first upload and refuses when it
+// answers nothing, then runs `npm publish --ignore-scripts --browser=false --otp=CODE` in each
+// directory back to back under captured pipes (npm's non-TTY guard turns a refused code into
+// EOTP with no prompt, so the path needs no TTY), journals each upload to tmp/units/publish-<name>.log, reads the `+ name@version`
+// acceptance line, stops at the first refusal and names the package to resume from, then confirms
+// each accepted version against the registry. --confirm re-reads the registry for each name@version every 5
+// seconds until it serves the version or the wait (default 120 seconds) ends. Exit 0 when the mode
+// succeeded, 3 when it did not, 64 on usage.
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { readList, readMissingFlags, readOption, readString, runNpm, } from "../../orkestrel-dispatch/scripts/helpers.js";
+const POLL_MS = 5_000;
+const ACCEPTED = /^\+ (\S+)@(\S+)\s*$/mu;
+function waitFor(ms) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
+function readWhoami() {
+    const result = runNpm(['whoami']);
+    const user = result.stdout.trim();
+    return result.status === 0 && user !== '' ? user : undefined;
+}
+async function pollWhoami(waitSeconds) {
+    const started = Date.now();
+    let user = readWhoami();
+    while (user === undefined && Date.now() - started < waitSeconds * 1000) {
+        await waitFor(POLL_MS);
+        user = readWhoami();
+    }
+    return user;
+}
+function readServed(name, version) {
+    const result = runNpm(['view', `${name}@${version}`, 'version', '--json']);
+    return result.status === 0 && result.stdout.replace(/["\s]/gu, '') === version;
+}
+async function confirmServed(name, version, waitSeconds) {
+    const started = Date.now();
+    let served = readServed(name, version);
+    while (!served && Date.now() - started < waitSeconds * 1000) {
+        await waitFor(POLL_MS);
+        served = readServed(name, version);
+    }
+    return served;
+}
+function readErrorCode(text) {
+    return text.match(/\b(E[A-Z0-9]{3,}|EOTP|E401|E403|E404)\b/u)?.[1];
+}
+function readManifestName(directory) {
+    const path = join(directory, 'package.json');
+    if (!existsSync(path))
+        return { name: undefined, version: undefined };
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        if (typeof parsed !== 'object' || parsed === null)
+            return { name: undefined, version: undefined };
+        const record = Object.fromEntries(Object.entries(parsed));
+        return { name: readString(record, 'name'), version: readString(record, 'version') };
+    }
+    catch {
+        return { name: undefined, version: undefined };
+    }
+}
+async function publishAll(directories, otp, waitSeconds) {
+    mkdirSync('tmp/units', { recursive: true });
+    const uploads = [];
+    for (const directory of directories) {
+        const manifest = readManifestName(directory);
+        const journal = `tmp/units/publish-${(manifest.name ?? directory).replace(/[^A-Za-z0-9.-]+/gu, '-')}.log`;
+        const result = runNpm(['publish', '--ignore-scripts', '--browser=false', `--otp=${otp}`], directory);
+        writeFileSync(journal, `${result.stdout}\n${result.stderr}\nexit=${result.status ?? 'null'}\n`);
+        const match = `${result.stdout}\n${result.stderr}`.match(ACCEPTED);
+        const accepted = result.status === 0 && match !== null;
+        const name = match?.[1] ?? manifest.name;
+        const version = match?.[2] ?? manifest.version;
+        const upload = {
+            directory,
+            name,
+            version,
+            exit: result.status ?? undefined,
+            accepted,
+            confirmed: false,
+            code: accepted ? undefined : readErrorCode(result.stderr),
+            journal,
+        };
+        if (!accepted) {
+            uploads.push(upload);
+            console.error(`window: ${name ?? directory} refused (${upload.code ?? `exit ${String(result.status)}`}); resume from it on a fresh code`);
+            break;
+        }
+        console.error(`window: accepted ${name ?? '?'}@${version ?? '?'}`);
+        uploads.push(upload);
+    }
+    const confirmed = [];
+    for (const upload of uploads) {
+        if (!upload.accepted || upload.name === undefined || upload.version === undefined) {
+            confirmed.push(upload);
+            continue;
+        }
+        confirmed.push({
+            ...upload,
+            confirmed: await confirmServed(upload.name, upload.version, waitSeconds),
+        });
+    }
+    return confirmed;
+}
+async function main(argv) {
+    const missing = readMissingFlags(argv, ['--wait', '--otp']);
+    if (missing.length > 0) {
+        console.error(`window: ${missing.join(', ')} given with no value`);
+        return 64;
+    }
+    const wait = Number(readOption(argv, '--wait') ?? 120);
+    const modes = ['--whoami', '--login', '--publish', '--confirm'].filter((flag) => argv.includes(flag));
+    if (modes.length > 1 || (argv.includes('--wait') && (!Number.isFinite(wait) || wait < 0))) {
+        console.error('usage: window.ts names one mode (--whoami | --login | --publish | --confirm), and --wait takes a number of seconds');
+        return 64;
+    }
+    if (argv.includes('--whoami')) {
+        const user = await pollWhoami(argv.includes('--wait') ? wait : 0);
+        console.log(JSON.stringify({ mode: 'whoami', user, live: user !== undefined }));
+        return user === undefined ? 3 : 0;
+    }
+    if (argv.includes('--login')) {
+        const command = process.platform === 'win32'
+            ? 'npm login --browser=false'
+            : "script -qfc 'npm login --browser=false' tmp/units/npm-login.log";
+        console.error(`window: run this in a real terminal, then approve the URL it prints on its first line: ${command}`);
+        const user = await pollWhoami(argv.includes('--wait') ? wait : 300);
+        console.log(JSON.stringify({ mode: 'login', command, user, live: user !== undefined }));
+        return user === undefined ? 3 : 0;
+    }
+    if (argv.includes('--publish')) {
+        const directories = readList(argv, '--publish');
+        const otp = readOption(argv, '--otp');
+        if (directories.length === 0 ||
+            otp === undefined ||
+            !/^\d{6,8}$/u.test(otp) ||
+            directories.some((directory) => !existsSync(join(directory, 'package.json')))) {
+            console.error("usage: window.ts --publish DIR... --otp CODE [--wait SECONDS] [--json]; every DIR carries a package.json and CODE is the account's one-time code");
+            return 64;
+        }
+        // A stored credential expires mid-session, so the session-start answer does not hold here.
+        if (readWhoami() === undefined) {
+            console.error('window: npm whoami answers nothing immediately before the upload; run --login first');
+            return 3;
+        }
+        const uploads = await publishAll(directories, otp, wait);
+        if (argv.includes('--json'))
+            console.log(JSON.stringify({ mode: 'publish', uploads }));
+        else {
+            for (const upload of uploads) {
+                console.log(`window: ${upload.directory}\t${upload.name ?? '?'}@${upload.version ?? '?'}\t${upload.accepted ? 'accepted' : `refused ${upload.code ?? String(upload.exit)}`}\t${upload.confirmed ? 'confirmed' : 'unconfirmed'}\t${upload.journal}`);
+            }
+        }
+        return uploads.every((upload) => upload.accepted && upload.confirmed) ? 0 : 3;
+    }
+    if (argv.includes('--confirm')) {
+        const targets = readList(argv, '--confirm');
+        if (targets.length === 0 || targets.some((target) => !/^@?[^@]+@\S+$/u.test(target))) {
+            console.error('usage: window.ts --confirm NAME@VERSION... [--wait SECONDS]');
+            return 64;
+        }
+        const readings = [];
+        for (const target of targets) {
+            const at = target.lastIndexOf('@');
+            readings.push({
+                target,
+                served: await confirmServed(target.slice(0, at), target.slice(at + 1), wait),
+            });
+        }
+        console.log(JSON.stringify({ mode: 'confirm', readings }));
+        return readings.every((reading) => reading.served) ? 0 : 3;
+    }
+    console.error('usage: window.ts --whoami [--wait SECONDS] | --login [--wait SECONDS] | --publish DIR... --otp CODE [--json] | --confirm NAME@VERSION... [--wait SECONDS]');
+    return 64;
+}
+main(process.argv.slice(2)).then((code) => {
+    process.exitCode = code;
+});