@quiltdata/benchling-webhook 0.21.2-20261007T162722Z → 0.21.3

package/dist/scripts/version.js

@@ -1,16 +1,10 @@
 #!/usr/bin/env node
 "use strict";
 /**
- * Version management script - bumps version numbers and creates release tags
+ * Version management and release-tag tooling.
  *
- * Usage:
- *   node bin/version.ts          # Show all three version files
- *   node bin/version.ts patch    # 0.4.7 -> 0.4.8
- *   node bin/version.ts minor    # 0.4.7 -> 0.5.0
- *   node bin/version.ts major    # 0.4.7 -> 1.0.0
- *   node bin/version.ts sync     # Force TOML and YAML to match JSON version
- *   node bin/version.ts tag      # Create and push production release tag
- *   node bin/version.ts tag dev  # Create and push dev release tag
+ * Version bumps remain explicit commands. Release commands share tag construction,
+ * local/remote target verification, and annotated-tag creation semantics.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -46,13 +40,453 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitReleaseRepository = exports.defaultCommandRunner = exports.AUTOMATIC_RELEASE_TAGGER_EMAIL = exports.AUTOMATIC_RELEASE_TAGGER_NAME = void 0;
+exports.isSemanticVersion = isSemanticVersion;
+exports.parseReleaseVersion = parseReleaseVersion;
+exports.compareReleaseVersions = compareReleaseVersions;
+exports.productionTag = productionTag;
+exports.devTag = devTag;
+exports.annotatedTagMessage = annotatedTagMessage;
+exports.parseTag = parseTag;
+exports.isAutomaticReleaseTag = isAutomaticReleaseTag;
+exports.runAutomaticRelease = runAutomaticRelease;
+exports.validateReleaseContext = validateReleaseContext;
+exports.runProductionGate = runProductionGate;
+exports.main = main;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
-const packagePath = path.join(__dirname, "..", "package.json");
-const pyprojectPath = path.join(__dirname, "..", "docker", "pyproject.toml");
-const appManifestPath = path.join(__dirname, "..", "docker", "app-manifest.yaml");
-const pkg = JSON.parse(fs.readFileSync(packagePath, "utf8"));
+const projectRoot = path.join(__dirname, "..");
+const packagePath = path.join(projectRoot, "package.json");
+const pyprojectPath = path.join(projectRoot, "docker", "pyproject.toml");
+const appManifestPath = path.join(projectRoot, "docker", "app-manifest.yaml");
+exports.AUTOMATIC_RELEASE_TAGGER_NAME = "github-actions[bot]";
+exports.AUTOMATIC_RELEASE_TAGGER_EMAIL = "41898282+github-actions[bot]@users.noreply.github.com";
+const CORE_VERSION_PATTERN = "(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)";
+const PLAIN_VERSION_PATTERN = new RegExp(`^${CORE_VERSION_PATTERN}$`);
+const TIMESTAMP_VERSION_PATTERN = new RegExp(`^${CORE_VERSION_PATTERN}-(\\d{8}T\\d{6}Z)$`);
+const SEMVER_PATTERN = new RegExp(`^${CORE_VERSION_PATTERN}(?:-([0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*))?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$`);
+const defaultCommandRunner = (command, args, options) => {
+    const result = (0, child_process_1.spawnSync)(command, [...args], {
+        cwd: options.cwd,
+        encoding: "utf8",
+        stdio: options.inherit ? "inherit" : "pipe",
+    });
+    return {
+        status: result.status ?? 127,
+        stdout: result.stdout?.toString() ?? "",
+        stderr: [result.stderr?.toString(), result.error?.message].filter(Boolean).join("\n"),
+    };
+};
+exports.defaultCommandRunner = defaultCommandRunner;
+function commandFailure(command, args, result) {
+    const detail = result.stderr.trim() || result.stdout.trim() || `exit status ${result.status}`;
+    return new Error(`${command} ${args.join(" ")} failed: ${detail}`);
+}
+function runChecked(runner, command, args, cwd, inherit = false) {
+    const result = runner(command, args, { cwd, inherit });
+    if (result.status !== 0) {
+        throw commandFailure(command, args, result);
+    }
+    return result;
+}
+function normalizeSha(value, label) {
+    const sha = value.trim().toLowerCase();
+    if (!/^[0-9a-f]{40,64}$/.test(sha)) {
+        throw new Error(`${label} is not a full commit SHA: ${value || "<empty>"}`);
+    }
+    return sha;
+}
+function parseVersionParts(match) {
+    return {
+        major: Number.parseInt(match[1], 10),
+        minor: Number.parseInt(match[2], 10),
+        patch: Number.parseInt(match[3], 10),
+    };
+}
+function timestampIsValid(timestamp) {
+    const match = timestamp.match(/^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z$/);
+    if (!match) {
+        return false;
+    }
+    const iso = `${match[1]}-${match[2]}-${match[3]}T${match[4]}:${match[5]}:${match[6]}.000Z`;
+    const date = new Date(iso);
+    return !Number.isNaN(date.valueOf()) && date.toISOString() === iso;
+}
+function isSemanticVersion(version) {
+    const match = version.match(SEMVER_PATTERN);
+    if (!match) {
+        return false;
+    }
+    const prerelease = match[4];
+    if (!prerelease) {
+        return true;
+    }
+    return prerelease.split(".").every((identifier) => !/^\d+$/.test(identifier) || identifier === "0" || !identifier.startsWith("0"));
+}
+function parseReleaseVersion(version) {
+    const stableMatch = version.match(PLAIN_VERSION_PATTERN);
+    if (stableMatch) {
+        return {
+            ...parseVersionParts(stableMatch),
+            raw: version,
+            prerelease: false,
+        };
+    }
+    const timestampMatch = version.match(TIMESTAMP_VERSION_PATTERN);
+    if (timestampMatch && timestampIsValid(timestampMatch[4])) {
+        return {
+            ...parseVersionParts(timestampMatch),
+            raw: version,
+            prerelease: true,
+            timestamp: timestampMatch[4],
+        };
+    }
+    throw new Error(`Unsupported release version: ${version}`);
+}
+function compareReleaseVersions(left, right) {
+    const a = parseReleaseVersion(left);
+    const b = parseReleaseVersion(right);
+    for (const key of ["major", "minor", "patch"]) {
+        if (a[key] !== b[key]) {
+            return a[key] < b[key] ? -1 : 1;
+        }
+    }
+    if (a.prerelease !== b.prerelease) {
+        return a.prerelease ? -1 : 1;
+    }
+    if (!a.prerelease) {
+        return 0;
+    }
+    return a.timestamp === b.timestamp ? 0 : a.timestamp < b.timestamp ? -1 : 1;
+}
+function productionTag(version) {
+    const parsed = parseReleaseVersion(version);
+    if (parsed.prerelease) {
+        throw new Error(`Production tags require a plain semantic version: ${version}`);
+    }
+    return `v${version}`;
+}
+function devTag(version, now = new Date()) {
+    productionTag(version);
+    const timestamp = now.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
+    return `v${version}-${timestamp}`;
+}
+function annotatedTagMessage(tag) {
+    const release = parseTag(tag);
+    return release.isPrerelease
+        ? `Development pre-release (dev) ${tag}\n\nThis is a pre-release for testing purposes.`
+        : `Release ${tag}`;
+}
+function parseTag(tag) {
+    if (!tag.startsWith("v")) {
+        throw new Error(`Release tag must start with v: ${tag}`);
+    }
+    const version = tag.slice(1);
+    const release = parseReleaseVersion(version);
+    const baseVersion = `${release.major}.${release.minor}.${release.patch}`;
+    return {
+        tag,
+        version,
+        baseVersion,
+        isPrerelease: release.prerelease,
+    };
+}
+class GitReleaseRepository {
+    constructor(cwd, runner = exports.defaultCommandRunner) {
+        this.cwd = cwd;
+        this.runner = runner;
+    }
+    git(args, inherit = false) {
+        return this.runner("git", args, { cwd: this.cwd, inherit });
+    }
+    resolveCommit(ref) {
+        const args = ["rev-parse", `${ref}^{commit}`];
+        const result = this.git(args);
+        if (result.status !== 0) {
+            throw commandFailure("git", args, result);
+        }
+        return normalizeSha(result.stdout, ref);
+    }
+    commitExists(ref) {
+        const args = ["cat-file", "-e", `${ref}^{commit}`];
+        const result = this.git(args);
+        if (result.status === 0) {
+            return true;
+        }
+        if (result.status === 1 || result.status === 128) {
+            return false;
+        }
+        throw commandFailure("git", args, result);
+    }
+    readFileAtCommit(commit, file) {
+        const args = ["show", `${commit}:${file}`];
+        const result = this.git(args);
+        if (result.status !== 0) {
+            throw commandFailure("git", args, result);
+        }
+        return result.stdout;
+    }
+    localTagTarget(tag) {
+        const ref = `refs/tags/${tag}`;
+        const checkArgs = ["show-ref", "--verify", "--quiet", ref];
+        const check = this.git(checkArgs);
+        if (check.status === 1) {
+            return null;
+        }
+        if (check.status !== 0) {
+            throw commandFailure("git", checkArgs, check);
+        }
+        return this.resolveCommit(ref);
+    }
+    fetchedTagAnnotation(tag) {
+        const typeArgs = ["cat-file", "-t", "FETCH_HEAD"];
+        const typeResult = this.git(typeArgs);
+        if (typeResult.status !== 0) {
+            throw commandFailure("git", typeArgs, typeResult);
+        }
+        const objectType = typeResult.stdout.trim();
+        if (objectType === "commit") {
+            return null;
+        }
+        if (objectType !== "tag") {
+            throw new Error(`Remote tag ${tag} points to unsupported object type ${objectType}`);
+        }
+        const contentArgs = ["cat-file", "tag", "FETCH_HEAD"];
+        const contentResult = this.git(contentArgs);
+        if (contentResult.status !== 0) {
+            throw commandFailure("git", contentArgs, contentResult);
+        }
+        const separator = contentResult.stdout.indexOf("\n\n");
+        if (separator < 0) {
+            throw new Error(`Remote annotated tag ${tag} has malformed content`);
+        }
+        const headers = contentResult.stdout.slice(0, separator).split("\n");
+        if (!headers.includes(`tag ${tag}`)) {
+            throw new Error(`Remote annotated tag ${tag} has a mismatched internal tag name`);
+        }
+        const taggerHeader = headers.find((line) => line.startsWith("tagger "));
+        const tagger = taggerHeader?.match(/^tagger (.*) <([^<>]+)> \d+ [+-]\d{4}$/);
+        if (!tagger) {
+            throw new Error(`Remote annotated tag ${tag} has a malformed tagger identity`);
+        }
+        return {
+            message: contentResult.stdout.slice(separator + 2).replace(/\n+$/, ""),
+            taggerName: tagger[1],
+            taggerEmail: tagger[2],
+        };
+    }
+    remoteTag(tag) {
+        const ref = `refs/tags/${tag}`;
+        const lookupArgs = ["ls-remote", "--exit-code", "--refs", "origin", ref];
+        const lookup = this.git(lookupArgs);
+        if (lookup.status === 2) {
+            return null;
+        }
+        if (lookup.status !== 0) {
+            throw commandFailure("git", lookupArgs, lookup);
+        }
+        const lines = lookup.stdout.trim().split("\n").filter(Boolean);
+        if (lines.length !== 1 || !lines[0].endsWith(`\t${ref}`)) {
+            throw new Error(`Remote lookup for ${tag} returned ambiguous data`);
+        }
+        const fetchArgs = ["fetch", "--force", "--no-tags", "origin", ref];
+        const fetch = this.git(fetchArgs);
+        if (fetch.status !== 0) {
+            throw commandFailure("git", fetchArgs, fetch);
+        }
+        return {
+            targetSha: this.resolveCommit("FETCH_HEAD"),
+            annotation: this.fetchedTagAnnotation(tag),
+        };
+    }
+    remoteTagTarget(tag) {
+        return this.remoteTag(tag)?.targetSha ?? null;
+    }
+    createAnnotatedTag(tag, message, targetSha) {
+        runChecked(this.runner, "git", ["tag", "-a", tag, "-m", message, targetSha], this.cwd, true);
+    }
+    pushTag(tag) {
+        const ref = `refs/tags/${tag}`;
+        return this.git(["push", "origin", `${ref}:${ref}`], true).status === 0;
+    }
+    isClean() {
+        const args = ["status", "--porcelain", "--untracked-files=normal"];
+        const result = this.git(args);
+        if (result.status !== 0) {
+            throw commandFailure("git", args, result);
+        }
+        return result.stdout.trim() === "";
+    }
+}
+exports.GitReleaseRepository = GitReleaseRepository;
+function packageVersionFromContent(content, label) {
+    let value;
+    try {
+        value = JSON.parse(content);
+    }
+    catch (error) {
+        throw new Error(`Could not parse ${label}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!value || typeof value !== "object" || typeof value.version !== "string") {
+        throw new Error(`${label} does not contain a string version`);
+    }
+    return value.version;
+}
+function assertSemanticVersion(version, label) {
+    if (!isSemanticVersion(version)) {
+        throw new Error(`${label} is malformed: ${version}`);
+    }
+}
+function assertExpectedTarget(actual, expected, label) {
+    if (normalizeSha(actual, label) !== expected) {
+        throw new Error(`${label} points to ${actual}, expected ${expected}`);
+    }
+}
+function resolveBeforeCommit(repository, beforeSha) {
+    const supplied = beforeSha?.trim();
+    if (supplied && !/^0+$/.test(supplied) && repository.commitExists(supplied)) {
+        return repository.resolveCommit(supplied);
+    }
+    return repository.resolveCommit("HEAD^");
+}
+function verifiedResult(outcome, releaseRequired, tag, targetSha) {
+    return {
+        outcome,
+        releaseRequired,
+        verified: true,
+        tag,
+        targetSha,
+    };
+}
+function isAutomaticReleaseTag(tag, remote) {
+    const annotation = remote.annotation;
+    return annotation !== null
+        && annotation.message === annotatedTagMessage(tag)
+        && annotation.taggerName === exports.AUTOMATIC_RELEASE_TAGGER_NAME
+        && annotation.taggerEmail === exports.AUTOMATIC_RELEASE_TAGGER_EMAIL;
+}
+function inspectExistingTag(repository, tag, targetSha) {
+    const local = repository.localTagTarget(tag);
+    if (local) {
+        assertExpectedTarget(local, targetSha, `Local tag ${tag}`);
+    }
+    const remote = repository.remoteTag(tag);
+    if (remote) {
+        assertExpectedTarget(remote.targetSha, targetSha, `Remote tag ${tag}`);
+    }
+    if (local && !remote) {
+        throw new Error(`Local tag ${tag} exists but the exact remote tag is absent`);
+    }
+    return { local, remote };
+}
+function runVerifiedProductionGate(options, targetSha) {
+    options.runProductionGate();
+    if (!options.repository.isClean()) {
+        throw new Error("Production gate left uncommitted changes in the working tree");
+    }
+    assertExpectedTarget(options.repository.resolveCommit("HEAD"), targetSha, "HEAD after production gate");
+}
+function runAutomaticRelease(options) {
+    const targetSha = normalizeSha(options.repository.resolveCommit("HEAD"), "HEAD");
+    const githubSha = normalizeSha(options.githubSha, "GITHUB_SHA");
+    if (targetSha !== githubSha) {
+        throw new Error(`Checked-out HEAD ${targetSha} does not match GITHUB_SHA ${githubSha}`);
+    }
+    const beforeCommit = resolveBeforeCommit(options.repository, options.beforeSha);
+    const previousVersion = packageVersionFromContent(options.repository.readFileAtCommit(beforeCommit, "package.json"), `package.json at ${beforeCommit}`);
+    assertSemanticVersion(previousVersion, "Previous package version");
+    assertSemanticVersion(options.currentVersion, "Current package version");
+    if (previousVersion === options.currentVersion) {
+        return {
+            outcome: "no-version-change",
+            releaseRequired: false,
+            verified: false,
+            tag: "",
+            targetSha,
+        };
+    }
+    if (!PLAIN_VERSION_PATTERN.test(options.currentVersion)) {
+        return {
+            outcome: "non-production-version",
+            releaseRequired: false,
+            verified: false,
+            tag: "",
+            targetSha,
+        };
+    }
+    const tag = productionTag(options.currentVersion);
+    const initial = inspectExistingTag(options.repository, tag, targetSha);
+    if (initial.remote) {
+        if (!isAutomaticReleaseTag(tag, initial.remote)) {
+            return verifiedResult("verified-existing-tag", false, tag, targetSha);
+        }
+        runVerifiedProductionGate(options, targetSha);
+        const recovered = inspectExistingTag(options.repository, tag, targetSha);
+        if (!recovered.remote || !isAutomaticReleaseTag(tag, recovered.remote)) {
+            throw new Error(`Automatic release tag ${tag} changed during recovery verification`);
+        }
+        return verifiedResult("verified-recovered-tag", true, tag, targetSha);
+    }
+    runVerifiedProductionGate(options, targetSha);
+    const afterGate = inspectExistingTag(options.repository, tag, targetSha);
+    if (afterGate.remote) {
+        return verifiedResult("verified-race", true, tag, targetSha);
+    }
+    if (afterGate.local) {
+        throw new Error(`Local tag ${tag} appeared without a verified remote tag`);
+    }
+    options.repository.createAnnotatedTag(tag, annotatedTagMessage(tag), targetSha);
+    const localTarget = options.repository.localTagTarget(tag);
+    if (!localTarget) {
+        throw new Error(`Created tag ${tag} cannot be resolved locally`);
+    }
+    assertExpectedTarget(localTarget, targetSha, `Created tag ${tag}`);
+    const pushed = options.repository.pushTag(tag);
+    const remote = options.repository.remoteTag(tag);
+    if (!remote) {
+        throw new Error(`Tag push ${pushed ? "reported success" : "failed"}, but remote tag ${tag} is absent`);
+    }
+    assertExpectedTarget(remote.targetSha, targetSha, `Remote tag ${tag} after push`);
+    return verifiedResult(pushed ? "created" : "verified-race", true, tag, targetSha);
+}
+function validateReleaseContext(repository, tag, packageVersion, githubSha) {
+    const parsed = parseTag(tag);
+    assertSemanticVersion(packageVersion, "Current package version");
+    if (parsed.baseVersion !== packageVersion) {
+        throw new Error(`Tag ${tag} does not match package version ${packageVersion}`);
+    }
+    const targetSha = normalizeSha(repository.resolveCommit("HEAD"), "HEAD");
+    const expectedSha = normalizeSha(githubSha, "GITHUB_SHA");
+    if (targetSha !== expectedSha) {
+        throw new Error(`Checked-out HEAD ${targetSha} does not match GITHUB_SHA ${expectedSha}`);
+    }
+    const local = repository.localTagTarget(tag);
+    if (!local) {
+        throw new Error(`Release tag ${tag} is not present locally`);
+    }
+    assertExpectedTarget(local, targetSha, `Local release tag ${tag}`);
+    const remote = repository.remoteTag(tag);
+    if (!remote) {
+        throw new Error(`Release tag ${tag} is not present on origin`);
+    }
+    assertExpectedTarget(remote.targetSha, targetSha, `Remote release tag ${tag}`);
+    return {
+        ...parsed,
+        verified: true,
+        targetSha,
+    };
+}
+function runProductionGate(repository, cwd = projectRoot, runner = exports.defaultCommandRunner) {
+    runChecked(runner, "npm", ["run", "version:verify"], cwd, true);
+    runChecked(runner, "npm", ["test"], cwd, true);
+    if (!repository.isClean()) {
+        throw new Error("Full npm test gate left uncommitted changes in the working tree");
+    }
+}
+function readPackage() {
+    return JSON.parse(fs.readFileSync(packagePath, "utf8"));
+}
 function readPyprojectVersion() {
     const content = fs.readFileSync(pyprojectPath, "utf8");
     const match = content.match(/^version\s*=\s*"([^"]+)"/m);
@@ -64,42 +498,38 @@ function readAppManifestVersion() {
     return match ? match[1].trim() : null;
 }
 function parseVersion(version) {
-    const match = version.match(/^(\d+)\.(\d+)\.(\d+)$/);
+    const match = version.match(PLAIN_VERSION_PATTERN);
     if (!match) {
         throw new Error(`Invalid version format: ${version}`);
     }
-    return {
-        major: parseInt(match[1], 10),
-        minor: parseInt(match[2], 10),
-        patch: parseInt(match[3], 10),
-    };
+    return parseVersionParts(match);
 }
-function formatVersion(ver) {
-    return `${ver.major}.${ver.minor}.${ver.patch}`;
+function formatVersion(version) {
+    return `${version.major}.${version.minor}.${version.patch}`;
 }
 function bumpVersion(currentVersion, bumpType) {
-    const ver = parseVersion(currentVersion);
+    const version = parseVersion(currentVersion);
     switch (bumpType) {
         case "major":
-            ver.major++;
-            ver.minor = 0;
-            ver.patch = 0;
+            version.major++;
+            version.minor = 0;
+            version.patch = 0;
             break;
         case "minor":
-            ver.minor++;
-            ver.patch = 0;
+            version.minor++;
+            version.patch = 0;
             break;
         case "patch":
-            ver.patch++;
+            version.patch++;
             break;
         default:
             throw new Error(`Unknown bump type: ${bumpType}`);
     }
-    return formatVersion(ver);
+    return formatVersion(version);
 }
-function updatePackageVersion(newVersion) {
+function updatePackageVersion(pkg, newVersion) {
     pkg.version = newVersion;
-    fs.writeFileSync(packagePath, JSON.stringify(pkg, null, 2) + "\n");
+    fs.writeFileSync(packagePath, `${JSON.stringify(pkg, null, 2)}\n`);
     console.log(`✅ Updated package.json to version ${newVersion}`);
 }
 function updatePyprojectVersion(newVersion) {
@@ -107,17 +537,12 @@ function updatePyprojectVersion(newVersion) {
     content = content.replace(/^version\s*=\s*"[^"]+"/m, `version = "${newVersion}"`);
     fs.writeFileSync(pyprojectPath, content);
     console.log(`✅ Updated docker/pyproject.toml to version ${newVersion}`);
-    // Run uv sync to update uv.lock
-    try {
-        const dockerDir = path.join(__dirname, "..", "docker");
-        console.log("🔄 Running uv sync to update uv.lock...");
-        (0, child_process_1.execSync)("uv sync", { cwd: dockerDir, stdio: "inherit" });
-        console.log("✅ Updated docker/uv.lock");
+    const result = (0, exports.defaultCommandRunner)("uv", ["sync"], { cwd: path.join(projectRoot, "docker"), inherit: true });
+    if (result.status !== 0) {
+        console.error("⚠️  Warning: Failed to run uv sync; run it manually in docker/");
     }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error("⚠️  Warning: Failed to run uv sync:", message);
-        console.error("   You may need to run 'cd docker && uv sync' manually");
+    else {
+        console.log("✅ Updated docker/uv.lock");
     }
 }
 function updateAppManifestVersion(newVersion) {
@@ -126,215 +551,149 @@ function updateAppManifestVersion(newVersion) {
     fs.writeFileSync(appManifestPath, content);
     console.log(`✅ Updated docker/app-manifest.yaml to version ${newVersion}`);
 }
-function createGitTag(version, isDev, noPush) {
-    let tagName = `v${version}`;
-    // For dev releases, append timestamp to make unique
-    if (isDev) {
-        const timestamp = new Date().toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
-        tagName = `v${version}-${timestamp}`;
+function writeActionsOutputs(values) {
+    const lines = Object.entries(values).map(([key, value]) => `${key}=${String(value)}\n`).join("");
+    const outputPath = process.env.GITHUB_OUTPUT;
+    if (outputPath) {
+        fs.appendFileSync(outputPath, lines);
     }
-    const tagType = isDev ? "pre-release (dev)" : "release";
-    // Check if tag already exists
-    try {
-        (0, child_process_1.execSync)(`git rev-parse ${tagName}`, { stdio: "ignore" });
-        console.error(`❌ Tag ${tagName} already exists`);
-        process.exit(1);
-    }
-    catch {
-        // Tag doesn't exist, continue
-    }
-    // Create tag
-    const message = isDev
-        ? `Development ${tagType} ${tagName}\n\nThis is a pre-release for testing purposes.`
-        : `Release ${tagName}`;
-    (0, child_process_1.execSync)(`git tag -a ${tagName} -m "${message}"`, { stdio: "inherit" });
-    console.log(`✅ Created git tag ${tagName}`);
-    // Push tag unless --no-push is specified
-    if (!noPush) {
-        console.log("");
-        console.log(`Pushing tag ${tagName} to origin...`);
-        try {
-            (0, child_process_1.execSync)(`git push origin ${tagName}`, { stdio: "inherit" });
-            console.log(`✅ Pushed tag ${tagName} to origin`);
-            console.log("");
-            console.log("CI/CD pipeline will now:");
-            console.log("  - Run all tests");
-            console.log("  - Build and push Docker image to ECR");
-            console.log("  - Create GitHub release");
-            if (!isDev) {
-                console.log("  - Publish to NPM (production releases only)");
-            }
-            console.log("  - Publish to GitHub Packages");
-            console.log("");
-            console.log("Monitor progress at: https://github.com/quiltdata/benchling-webhook/actions");
-        }
-        catch {
-            console.error(`❌ Failed to push tag ${tagName}`);
-            console.error("You can manually push with: git push origin " + tagName);
-            process.exit(1);
-        }
+    console.log(lines.trim());
+}
+function createManualTag(repository, version, isDev, noPush) {
+    const tag = isDev ? devTag(version) : productionTag(version);
+    if (!repository.isClean()) {
+        throw new Error("You have uncommitted changes");
     }
-    else {
-        console.log("");
-        console.log("Tag created but not pushed (--no-push specified)");
-        console.log(`To push later: git push origin ${tagName}`);
-    }
-}
-function main() {
-    const args = process.argv.slice(2);
-    // No args: display all three versions
-    if (args.length === 0) {
-        const jsonVersion = pkg.version;
-        const tomlVersion = readPyprojectVersion();
-        const yamlVersion = readAppManifestVersion();
-        console.log("Version files:");
-        console.log(`  package.json:              ${jsonVersion}`);
-        console.log(`  docker/pyproject.toml:     ${tomlVersion}`);
-        console.log(`  docker/app-manifest.yaml:  ${yamlVersion}`);
-        if (jsonVersion === tomlVersion && jsonVersion === yamlVersion) {
-            console.log("\n✅ All versions are in sync");
+    if (repository.localTagTarget(tag)) {
+        throw new Error(`Tag ${tag} already exists locally`);
+    }
+    if (repository.remoteTag(tag)) {
+        throw new Error(`Tag ${tag} already exists on origin`);
+    }
+    const targetSha = repository.resolveCommit("HEAD");
+    repository.createAnnotatedTag(tag, annotatedTagMessage(tag), targetSha);
+    if (noPush) {
+        console.log(`✅ Created ${tag}; push later with: git push origin ${tag}`);
+        return tag;
+    }
+    const pushed = repository.pushTag(tag);
+    const remote = repository.remoteTag(tag);
+    if (!remote) {
+        throw new Error(`Failed to push tag ${tag}; the exact remote tag is absent`);
+    }
+    assertExpectedTarget(remote.targetSha, normalizeSha(targetSha, "HEAD"), `Remote tag ${tag}`);
+    console.log(`✅ ${pushed ? "Pushed" : "Verified concurrent push of"} tag ${tag}`);
+    return tag;
+}
+function printHelp(pkg) {
+    console.log(`Current version: ${pkg.version}\n`);
+    console.log("Usage: npm run version -- [command] [options]\n");
+    console.log("Version commands: major, minor, patch, sync");
+    console.log("Release commands: tag [dev] [--no-push], auto-tag, release-context");
+    console.log("Verification command: verify-clean-git");
+}
+function main(args = process.argv.slice(2)) {
+    const pkg = readPackage();
+    const repository = new GitReleaseRepository(projectRoot);
+    const command = args[0];
+    try {
+        if (!command) {
+            const tomlVersion = readPyprojectVersion();
+            const yamlVersion = readAppManifestVersion();
+            console.log("Version files:");
+            console.log(`  package.json:              ${pkg.version}`);
+            console.log(`  docker/pyproject.toml:     ${tomlVersion}`);
+            console.log(`  docker/app-manifest.yaml:  ${yamlVersion}`);
+            console.log(pkg.version === tomlVersion && pkg.version === yamlVersion
+                ? "\n✅ All versions are in sync"
+                : "\n⚠️  Versions are out of sync! Run npm run version -- sync to fix.");
+            return 0;
         }
-        else {
-            console.log("\n⚠️  Versions are out of sync! Run \"node bin/version.ts sync\" to fix.");
+        if (args.includes("--help") || args.includes("-h")) {
+            printHelp(pkg);
+            return 0;
         }
-        process.exit(0);
-    }
-    // Help
-    if (args.includes("--help") || args.includes("-h")) {
-        console.log("Current version:", pkg.version);
-        console.log("");
-        console.log("Usage: node bin/version.ts [command] [options]");
-        console.log("");
-        console.log("Version Management Commands:");
-        console.log("  (no args)  - Display all three version files");
-        console.log("  major      - Bump major version (1.0.0 -> 2.0.0)");
-        console.log("  minor      - Bump minor version (0.4.7 -> 0.5.0)");
-        console.log("  patch      - Bump patch version (0.4.7 -> 0.4.8)");
-        console.log("  sync       - Force TOML and YAML to match JSON version");
-        console.log("");
-        console.log("Release Tagging Commands:");
-        console.log("  tag              - Create and push production release tag");
-        console.log("  tag dev          - Create and push dev release tag with timestamp");
-        console.log("  verify-clean-git - Check for uncommitted changes (pre-flight check)");
-        console.log("");
-        console.log("Options:");
-        console.log("  --no-push  - Create tag but do not push to origin (tag command only)");
-        console.log("");
-        console.log("This script manages version numbers in:");
-        console.log("  - package.json");
-        console.log("  - docker/pyproject.toml");
-        console.log("  - docker/app-manifest.yaml");
-        console.log("  - docker/uv.lock (via uv sync)");
-        console.log("");
-        console.log("Examples:");
-        console.log("  npm run version              # Show versions");
-        console.log("  npm run version patch        # Bump patch version");
-        console.log("  npm run version:tag          # Create production release tag");
-        console.log("  npm run version:tag:dev      # Create dev release tag");
-        process.exit(0);
-    }
-    const bumpType = args[0];
-    // Verify clean git command - check for uncommitted changes
-    if (bumpType === "verify-clean-git") {
-        try {
-            (0, child_process_1.execSync)("git diff-index --quiet HEAD --", { stdio: "ignore" });
+        if (command === "verify-clean-git") {
+            if (!repository.isClean()) {
+                throw new Error("You have uncommitted changes");
+            }
             console.log("✅ Git working directory is clean");
-            process.exit(0);
-        }
-        catch {
-            console.error("❌ You have uncommitted changes");
-            console.error("   Commit or stash your changes before creating a release");
-            process.exit(1);
+            return 0;
         }
-    }
-    // Sync command - force TOML and YAML to match JSON
-    if (bumpType === "sync") {
-        const jsonVersion = pkg.version;
-        const tomlVersion = readPyprojectVersion();
-        const yamlVersion = readAppManifestVersion();
-        console.log("Syncing versions to match package.json:");
-        console.log(`  package.json:              ${jsonVersion}`);
-        console.log(`  docker/pyproject.toml:     ${tomlVersion} -> ${jsonVersion}`);
-        console.log(`  docker/app-manifest.yaml:  ${yamlVersion} -> ${jsonVersion}`);
-        console.log("");
-        try {
-            updatePyprojectVersion(jsonVersion);
-            updateAppManifestVersion(jsonVersion);
-            // Check if version files have changes
-            let hasChanges = false;
+        if (command === "auto-tag") {
             try {
-                (0, child_process_1.execSync)("git diff --quiet docker/pyproject.toml docker/app-manifest.yaml docker/uv.lock", { stdio: "ignore" });
-            }
-            catch {
-                hasChanges = true;
+                const result = runAutomaticRelease({
+                    repository,
+                    currentVersion: pkg.version,
+                    beforeSha: process.env.GITHUB_EVENT_BEFORE,
+                    githubSha: process.env.GITHUB_SHA ?? "",
+                    runProductionGate: () => runProductionGate(repository),
+                });
+                writeActionsOutputs({
+                    outcome: result.outcome,
+                    release_required: result.releaseRequired,
+                    verified: result.verified,
+                    tag: result.tag,
+                    target_sha: result.targetSha,
+                });
+                return 0;
             }
-            if (hasChanges) {
-                (0, child_process_1.execSync)("git add docker/pyproject.toml docker/app-manifest.yaml docker/uv.lock", { stdio: "inherit" });
-                (0, child_process_1.execSync)(`git commit -m "chore: sync versions to ${jsonVersion}"`, { stdio: "inherit" });
-                console.log("✅ Committed version sync");
-            }
-            else {
-                console.log("✅ All versions already in sync (no changes to commit)");
+            catch (error) {
+                writeActionsOutputs({
+                    outcome: "failure",
+                    release_required: false,
+                    verified: false,
+                    tag: "",
+                    target_sha: "",
+                });
+                throw error;
             }
         }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            console.error("❌ Error:", message);
-            process.exit(1);
+        if (command === "release-context") {
+            const tag = args[1] ?? process.env.RELEASE_TAG ?? "";
+            const context = validateReleaseContext(repository, tag, pkg.version, process.env.GITHUB_SHA ?? "");
+            writeActionsOutputs({
+                verified: context.verified,
+                tag: context.tag,
+                version: context.version,
+                base_version: context.baseVersion,
+                target_sha: context.targetSha,
+                is_prerelease: context.isPrerelease,
+            });
+            return 0;
         }
-        process.exit(0);
-    }
-    // Tag command - create and push git tags
-    if (bumpType === "tag") {
-        // Check for uncommitted changes
-        try {
-            (0, child_process_1.execSync)("git diff-index --quiet HEAD --", { stdio: "ignore" });
+        if (command === "sync") {
+            updatePyprojectVersion(pkg.version);
+            updateAppManifestVersion(pkg.version);
+            const diff = (0, exports.defaultCommandRunner)("git", ["diff", "--quiet", "docker/pyproject.toml", "docker/app-manifest.yaml", "docker/uv.lock"], { cwd: projectRoot });
+            if (diff.status !== 0) {
+                runChecked(exports.defaultCommandRunner, "git", ["add", "docker/pyproject.toml", "docker/app-manifest.yaml", "docker/uv.lock"], projectRoot, true);
+                runChecked(exports.defaultCommandRunner, "git", ["commit", "-m", `chore: sync versions to ${pkg.version}`], projectRoot, true);
+            }
+            return 0;
         }
-        catch {
-            console.error("❌ You have uncommitted changes");
-            console.error("   Commit or stash your changes before creating a release");
-            process.exit(1);
+        if (command === "tag") {
+            createManualTag(repository, pkg.version, args.includes("dev"), args.includes("--no-push"));
+            return 0;
         }
-        const isDev = args.includes("dev");
-        const noPush = args.includes("--no-push");
-        const version = pkg.version;
-        console.log(`Creating ${isDev ? "dev" : "production"} release from version: ${version}`);
-        console.log("");
-        createGitTag(version, isDev, noPush);
-        process.exit(0);
-    }
-    // Check for uncommitted changes (for version bump commands)
-    try {
-        (0, child_process_1.execSync)("git diff-index --quiet HEAD --", { stdio: "ignore" });
-    }
-    catch {
-        console.error("❌ You have uncommitted changes");
-        console.error("   Commit or stash your changes before bumping version");
-        process.exit(1);
-    }
-    try {
-        const currentVersion = pkg.version;
-        const newVersion = bumpVersion(currentVersion, bumpType);
-        console.log(`Bumping version: ${currentVersion} -> ${newVersion}`);
-        console.log("");
-        // Update all version files
-        updatePackageVersion(newVersion);
+        if (!repository.isClean()) {
+            throw new Error("You have uncommitted changes");
+        }
+        const newVersion = bumpVersion(pkg.version, command);
+        console.log(`Bumping version: ${pkg.version} -> ${newVersion}`);
+        updatePackageVersion(pkg, newVersion);
         updatePyprojectVersion(newVersion);
         updateAppManifestVersion(newVersion);
-        // Commit the changes
-        (0, child_process_1.execSync)("git add package.json docker/pyproject.toml docker/app-manifest.yaml docker/uv.lock", { stdio: "inherit" });
-        (0, child_process_1.execSync)(`git commit -m "chore: bump version to ${newVersion}"`, { stdio: "inherit" });
-        console.log("✅ Committed version change");
-        console.log("");
-        console.log("Next steps:");
-        console.log("  1. Push changes: git push");
-        console.log("  2. Create release tag: npm run version:tag (or npm run version:tag:dev for dev release)");
+        runChecked(exports.defaultCommandRunner, "git", ["add", "package.json", "docker/pyproject.toml", "docker/app-manifest.yaml", "docker/uv.lock"], projectRoot, true);
+        runChecked(exports.defaultCommandRunner, "git", ["commit", "-m", `chore: bump version to ${newVersion}`], projectRoot, true);
+        return 0;
     }
     catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error("❌ Error:", message);
-        process.exit(1);
+        console.error(`❌ ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
     }
 }
-main();
+if (require.main === module) {
+    process.exitCode = main();
+}
 //# sourceMappingURL=version.js.map