@rathnasgala/cli 0.0.21 → 1.0.0

package/src/github-template-repository.js

@@ -1,165 +0,0 @@
-import { spawn } from 'node:child_process';
-import path from 'node:path';
-import { describeHttpFailure } from './http-failure.js';
-
-const GITHUB_API_VERSION = '2026-03-10';
-const REPOSITORY_IDENTITY = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
-
-function requiredString(value, field) {
-  if (typeof value !== 'string' || value.trim() === '') {
-    throw new TypeError(`${field} is required`);
-  }
-  return value.trim();
-}
-
-function repositorySegment(value, field) {
-  const segment = requiredString(value, field);
-  if (!/^[A-Za-z0-9_.-]+$/.test(segment)) {
-    throw new TypeError(`${field} contains unsupported characters`);
-  }
-  return segment;
-}
-
-export async function generateRepositoryFromTemplate({
-  accessToken,
-  templateOwner,
-  templateRepository,
-  owner,
-  repository,
-  description,
-  fetchImpl = fetch,
-  sleep,
-  readinessAttempts,
-  readinessIntervalMs
-}) {
-  const token = requiredString(accessToken, 'accessToken');
-  const sourceOwner = repositorySegment(templateOwner, 'templateOwner');
-  const sourceRepository = repositorySegment(templateRepository, 'templateRepository');
-  const targetOwner = repositorySegment(owner, 'owner');
-  const targetRepository = repositorySegment(repository, 'repository');
-  if (description != null && typeof description !== 'string') {
-    throw new TypeError('description must be a string');
-  }
-
-  const response = await fetchImpl(
-    `https://api.github.com/repos/${encodeURIComponent(sourceOwner)}/${encodeURIComponent(sourceRepository)}/generate`,
-    {
-      method: 'POST',
-      headers: {
-        accept: 'application/vnd.github+json',
-        authorization: `Bearer ${token}`,
-        'content-type': 'application/json',
-        'x-github-api-version': GITHUB_API_VERSION
-      },
-      body: JSON.stringify({
-        owner: targetOwner,
-        name: targetRepository,
-        description: description ?? '',
-        include_all_branches: false,
-        private: false
-      })
-    }
-  );
-  if (response.status !== 201) {
-    throw new Error(await describeHttpFailure(response, 'GitHub template generation'));
-  }
-  const payload = await response.json();
-  if (payload == null || Array.isArray(payload) || typeof payload !== 'object') {
-    throw new TypeError('GitHub repository response must be a JSON object');
-  }
-  const fullName = requiredString(payload.full_name, 'full_name');
-  if (!REPOSITORY_IDENTITY.test(fullName)) {
-    throw new TypeError('GitHub repository response contains an invalid full_name');
-  }
-  if (fullName.toLowerCase() !== `${targetOwner}/${targetRepository}`.toLowerCase()) {
-    throw new TypeError('GitHub generated an unexpected repository');
-  }
-
-  const cloneUrl = new URL(requiredString(payload.clone_url, 'clone_url'));
-  if (
-    cloneUrl.protocol !== 'https:'
-    || cloneUrl.hostname !== 'github.com'
-    || cloneUrl.username !== ''
-    || cloneUrl.password !== ''
-    || cloneUrl.search !== ''
-    || cloneUrl.hash !== ''
-    || cloneUrl.pathname.toLowerCase() !== `/${fullName}.git`.toLowerCase()
-  ) {
-    throw new TypeError('GitHub repository response contains an invalid clone_url');
-  }
-
-  // Last, so a malformed response fails immediately instead of after the readiness wait.
-  await awaitRepositoryContent({
-    accessToken: token, owner: targetOwner, repository: targetRepository, fetchImpl,
-    ...(sleep == null ? {} : { sleep }),
-    ...(readinessAttempts == null ? {} : { attempts: readinessAttempts }),
-    ...(readinessIntervalMs == null ? {} : { intervalMs: readinessIntervalMs })
-  });
-
-  return Object.freeze({ fullName, cloneUrl: cloneUrl.href });
-}
-
-/**
- * Waits for a generated repository to actually contain the template.
- *
- * Generating from a template is asynchronous: GitHub answers 201 with the repository's full name
- * and clone URL, and copies the content in afterwards. Cloning on the 201 produced
- * "warning: You appear to have cloned an empty repository", and scaffolding then failed on a
- * missing site.config.yml — a confusing error about a file the template certainly contains.
- *
- * Readiness is the presence of a branch. `size` is not usable: GitHub still reported 0 for a
- * repository that already had `main` and commits.
- */
-export async function awaitRepositoryContent({
-  accessToken, owner, repository, fetchImpl = fetch,
-  sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
-  attempts = 30, intervalMs = 1_000
-}) {
-  const url = `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/branches?per_page=1`;
-  for (let attempt = 0; attempt < attempts; attempt += 1) {
-    if (attempt > 0) await sleep(intervalMs);
-    const response = await fetchImpl(url, {
-      headers: {
-        accept: 'application/vnd.github+json',
-        authorization: `Bearer ${accessToken}`,
-        'x-github-api-version': GITHUB_API_VERSION
-      }
-    });
-    if (!response.ok) throw new Error(await describeHttpFailure(response, 'GitHub branch lookup'));
-    const branches = await response.json();
-    if (Array.isArray(branches) && branches.length > 0) return;
-  }
-  throw new Error(
-    `GitHub created ${owner}/${repository} from the template but it was still empty after `
-    + `${Math.round((attempts * intervalMs) / 1000)}s. Re-run scaffold with --resume once it has content.`
-  );
-}
-
-export function cloneRepository({ cloneUrl, target, spawnProcess = spawn }) {
-  const source = new URL(requiredString(cloneUrl, 'cloneUrl'));
-  if (
-    source.protocol !== 'https:'
-    || source.hostname !== 'github.com'
-    || source.username !== ''
-    || source.password !== ''
-    || source.search !== ''
-    || source.hash !== ''
-  ) {
-    throw new TypeError('cloneUrl must be an uncredentialed GitHub HTTPS URL');
-  }
-  const resolvedTarget = path.resolve(requiredString(target, 'target'));
-
-  return new Promise((resolve, reject) => {
-    const child = spawnProcess('git', ['clone', source.href, resolvedTarget], {
-      cwd: path.dirname(resolvedTarget),
-      shell: false,
-      stdio: 'inherit'
-    });
-    child.once('error', reject);
-    child.once('exit', (code, signal) => {
-      if (signal) reject(new Error(`Git clone terminated by signal ${signal}`));
-      else if (code !== 0) reject(new Error(`Git clone exited with code ${code}`));
-      else resolve(resolvedTarget);
-    });
-  });
-}

package/src/hook-command.js

@@ -1,64 +0,0 @@
-import { lstat, mkdir, readFile, writeFile } from 'node:fs/promises';
-import path from 'node:path';
-
-const MARKER = '// Managed by @rathnasgala/cli. Do not edit.\n';
-const HOOK = `#!/usr/bin/env node
-${MARKER}const { spawnSync } = require('node:child_process');
-const path = require('node:path');
-
-const root = process.cwd();
-const executable = path.join(
-  root,
-  'node_modules',
-  '.bin',
-  process.platform === 'win32' ? 'gala.cmd' : 'gala'
-);
-const result = spawnSync(executable, ['validate', '--root', root], {
-  cwd: root,
-  shell: false,
-  stdio: 'inherit'
-});
-if (result.error) {
-  console.error('Gala validation hook failed to start:', result.error.message);
-  process.exit(1);
-}
-process.exit(result.status ?? 1);
-`;
-
-async function metadata(file, allowMissing = false) {
-  try {
-    return await lstat(file);
-  } catch (error) {
-    if (allowMissing && error.code === 'ENOENT') return null;
-    throw error;
-  }
-}
-
-export async function installPrePushHook(root) {
-  const resolvedRoot = path.resolve(root);
-  const gitDirectory = path.join(resolvedRoot, '.git');
-  const gitMetadata = await metadata(gitDirectory);
-  if (!gitMetadata.isDirectory() || gitMetadata.isSymbolicLink()) {
-    throw new TypeError('.git must be a real directory');
-  }
-
-  const hooksDirectory = path.join(gitDirectory, 'hooks');
-  const hooksMetadata = await metadata(hooksDirectory, true);
-  if (hooksMetadata?.isSymbolicLink() || (hooksMetadata && !hooksMetadata.isDirectory())) {
-    throw new TypeError('.git/hooks must be a real directory');
-  }
-  if (!hooksMetadata) await mkdir(hooksDirectory);
-
-  const target = path.join(hooksDirectory, 'pre-push');
-  const existing = await metadata(target, true);
-  if (existing) {
-    if (!existing.isFile() || existing.isSymbolicLink()) {
-      throw new TypeError('Existing pre-push hook must be a regular file');
-    }
-    if (await readFile(target, 'utf8') === HOOK) return { target, installed: false };
-    throw new Error('Refusing to overwrite an existing pre-push hook');
-  }
-
-  await writeFile(target, HOOK, { encoding: 'utf8', flag: 'wx', mode: 0o755 });
-  return { target, installed: true };
-}

package/src/http-failure.js

@@ -1,55 +0,0 @@
-/**
- * What the server actually said, instead of only what it scored.
- *
- * Every failure in this CLI reported `failed with HTTP 403` and discarded the response body. GitHub
- * puts the reason there and nowhere else — an organisation's OAuth App restrictions, a missing
- * scope, a rename, a rate limit all arrive as 403 with a sentence explaining which — so the one
- * fact worth having was the one being thrown away. Diagnosing anything meant guessing between
- * causes the server had already distinguished.
- *
- * Only the response is read. Request bodies, tokens and secrets never pass through here.
- */
-const MAX_DETAIL = 400;
-
-export async function describeHttpFailure(response, action) {
-  const status = response?.status ?? 0;
-  let detail = '';
-  try {
-    // Cloned so a caller that also reads the body still can; a response whose body is already
-    // consumed simply yields no detail rather than a second failure on top of the first.
-    const text = await (typeof response.clone === 'function' ? response.clone() : response).text();
-    detail = extract(text);
-  } catch {
-    detail = '';
-  }
-  return `${action} failed with HTTP ${status}${detail === '' ? '' : `: ${detail}`}`;
-}
-
-function extract(text) {
-  if (typeof text !== 'string' || text.trim() === '') return '';
-  let payload;
-  try {
-    payload = JSON.parse(text);
-  } catch {
-    return truncate(text);
-  }
-  if (payload == null || typeof payload !== 'object') return truncate(text);
-  const parts = [];
-  if (typeof payload.message === 'string' && payload.message.trim() !== '') parts.push(payload.message.trim());
-  // GitHub's `errors` array carries the specific field or reason behind a generic message.
-  if (Array.isArray(payload.errors)) {
-    for (const error of payload.errors) {
-      const reason = typeof error === 'string' ? error : error?.message ?? error?.code;
-      if (typeof reason === 'string' && reason.trim() !== '') parts.push(reason.trim());
-    }
-  }
-  if (typeof payload.error_description === 'string') parts.push(payload.error_description.trim());
-  if (typeof payload.code === 'string' && parts.length === 0) parts.push(payload.code);
-  if (typeof payload.documentation_url === 'string') parts.push(`See ${payload.documentation_url}`);
-  return truncate(parts.length === 0 ? text : parts.join(' — '));
-}
-
-function truncate(value) {
-  const flattened = value.replace(/\s+/g, ' ').trim();
-  return flattened.length > MAX_DETAIL ? `${flattened.slice(0, MAX_DETAIL)}…` : flattened;
-}

package/src/new-command.js

@@ -1,54 +0,0 @@
-import { mkdir, readFile, readdir, writeFile } from 'node:fs/promises';
-import path from 'node:path';
-
-import {
-  createPostMetadata,
-  isContentId,
-  parseFrontmatter,
-  slugifyTitle
-} from '@rathnasgala/content-validation';
-import { stringify } from 'yaml';
-import { repositoryEvaluationDate } from './evaluation-date.js';
-
-export async function createPost({ root, title, language, today, now = Date.now }) {
-  const siteRoot = path.resolve(root);
-  const creationTimestamp = now();
-  const publishAfterDate = today ?? await repositoryEvaluationDate({
-    root: siteRoot,
-    now: () => creationTimestamp
-  });
-  const metadata = createPostMetadata({
-    title,
-    language,
-    today: publishAfterDate,
-    timestamp: creationTimestamp
-  });
-  const postDirectory = path.join(siteRoot, 'content', 'posts', slugifyTitle(title));
-  const mediaDirectory = path.join(postDirectory, 'media');
-  const postPath = path.join(postDirectory, `index.${metadata.language}.md`);
-
-  await mkdir(postDirectory, { recursive: true });
-  const variants = (await readdir(postDirectory, { withFileTypes: true }))
-    .filter((entry) => entry.isFile() && /^index\.[^.]+\.md$/.test(entry.name));
-  const existingIds = new Set();
-  for (const variant of variants) {
-    const variantPath = path.join(postDirectory, variant.name);
-    const parsed = parseFrontmatter(await readFile(variantPath, 'utf8'));
-    if (parsed.errors.length > 0) {
-      throw new Error(`Existing variant has invalid frontmatter: ${variantPath}`);
-    }
-    if (!isContentId(parsed.data.id)) {
-      throw new Error(`Existing variant is missing a valid article id: ${variantPath}`);
-    }
-    existingIds.add(parsed.data.id);
-  }
-  if (existingIds.size > 1) {
-    throw new Error(`Existing variants have conflicting article ids: ${postDirectory}`);
-  }
-  if (existingIds.size === 1) metadata.id = existingIds.values().next().value;
-
-  await mkdir(mediaDirectory, { recursive: true });
-  const source = `---\n${stringify(metadata).trimEnd()}\n---\n\n# ${title}\n`;
-  await writeFile(postPath, source, { encoding: 'utf8', flag: 'wx' });
-  return { metadata, postPath, mediaDirectory };
-}

package/src/open-browser.js

@@ -1,40 +0,0 @@
-import { spawn } from 'node:child_process';
-
-/**
- * Opens a URL in the writer's browser, best effort.
- *
- * Printing "Open https://…" and a code asks someone to copy a URL out of a terminal by hand, three
- * times over in one scaffold. The URL is still always printed — this only saves the copying, and it
- * has to keep working when it cannot: over SSH, in a container, in CI, on a machine with no browser
- * at all. So nothing here is allowed to fail the command.
- *
- * Deliberately not attempted when there is no terminal. A CI job that silently spawns a browser
- * process is a hang waiting to happen, and there is nobody there to look at it.
- */
-export function openInBrowser(url, {
-  platform = process.platform,
-  environment = process.env,
-  interactive = process.stdin.isTTY === true,
-  spawnProcess = spawn
-} = {}) {
-  if (!interactive) return false;
-  // Respected by convention across CLI tooling, and the escape hatch for anyone who does not want
-  // their browser taken over.
-  if (environment.GALA_NO_BROWSER || environment.CI || environment.NO_BROWSER) return false;
-  if (!/^https:\/\//.test(url)) return false;
-
-  const [command, args] = platform === 'darwin' ? ['open', [url]]
-    : platform === 'win32' ? ['cmd', ['/c', 'start', '', url]]
-      : ['xdg-open', [url]];
-
-  try {
-    const child = spawnProcess(command, args, { stdio: 'ignore', detached: true, shell: false });
-    // Without this the CLI waits for the browser to exit before it can finish.
-    child.unref?.();
-    // A missing opener is an ordinary outcome on a headless box, not something to report.
-    child.on?.('error', () => {});
-    return true;
-  } catch {
-    return false;
-  }
-}

package/src/preview-command.js

@@ -1,60 +0,0 @@
-import { spawn } from 'node:child_process';
-import path from 'node:path';
-
-import { regenerateBuildManifest } from './validate-command.js';
-
-const BUILD_WARNING_DELAY_MS = (5 * 60 * 1000) + 1;
-const INITIAL_BUILD_COMPLETE = /\bWrote \d+ files?\b/;
-
-export async function previewSite({
-  root,
-  today,
-  spawnProcess = spawn,
-  schedule = setTimeout,
-  cancel = clearTimeout,
-  output = process.stdout,
-  warningOutput = process.stderr
-}) {
-  const siteRoot = path.resolve(root);
-  const { results: validation } = await regenerateBuildManifest({ root: siteRoot, today });
-  const failures = validation.filter(({ errors }) => errors.length > 0);
-  if (failures.length > 0) {
-    throw new Error(`Preview refused: ${failures.length} post variant(s) failed validation`);
-  }
-
-  const cli = path.join(siteRoot, 'node_modules', '@11ty', 'eleventy', 'cmd.cjs');
-  const child = spawnProcess(process.execPath, [cli, '--serve', '--watch'], {
-    cwd: siteRoot,
-    env: { ...process.env, GALA_EVALUATION_DATE: today },
-    shell: false,
-    stdio: ['inherit', 'pipe', 'pipe']
-  });
-
-  return new Promise((resolve, reject) => {
-    let initialOutput = '';
-    let warningTimer = schedule(() => {
-      warningOutput.write('warning\tbuild-duration-5m\n');
-      warningTimer = undefined;
-    }, BUILD_WARNING_DELAY_MS);
-    const stopTimer = () => {
-      if (warningTimer !== undefined) cancel(warningTimer);
-      warningTimer = undefined;
-    };
-    child.stdout?.on('data', (chunk) => {
-      output.write(chunk);
-      initialOutput = `${initialOutput}${chunk}`.slice(-256);
-      if (INITIAL_BUILD_COMPLETE.test(initialOutput)) stopTimer();
-    });
-    child.stderr?.on('data', (chunk) => warningOutput.write(chunk));
-    child.once('error', (error) => {
-      stopTimer();
-      reject(error);
-    });
-    child.once('exit', (code, signal) => {
-      stopTimer();
-      if (signal) reject(new Error(`Preview terminated by signal ${signal}`));
-      else if (code !== 0) reject(new Error(`Preview exited with code ${code}`));
-      else resolve();
-    });
-  });
-}

package/src/publication-creation-client.js

@@ -1,144 +0,0 @@
-/**
- * Creates the publication repository the way the browser editor does.
- *
- * The CLI used to call `POST /repos/{template}/generate` itself. That is a second, worse
- * implementation of something the API already does and does properly:
- *
- *  - it tries the template, then falls back to creating an empty repository and seeding it, then
- *    reports that the writer must do it by hand — the CLI's single attempt had no rung below it;
- *  - it waits for the Gala App installation to actually reach the new repository before calling it
- *    ready, which is why repositories the CLI created never appeared in the web UI;
- *  - it returns the installation id, so registration cannot disagree with creation about which
- *    installation owns the repository.
- *
- * One implementation, exercised by both clients, is the only way the two stay in step.
- */
-import { describeHttpFailure } from './http-failure.js';
-import { exchangeGithubAuthorization } from './site-registration-client.js';
-
-export async function createPublication({
-  apiBaseUrl = 'https://api.gala67.com',
-  galaAccessToken,
-  githubAccessToken,
-  name,
-  fetchImpl = fetch,
-  authorize = exchangeGithubAuthorization,
-  notify = () => {},
-  ask,
-  openUrl = () => false,
-  shareAttempts = 3,
-  selfLogin
-}) {
-  let created = false;
-  let shareUrl = 'https://github.com/settings/installations';
-  let repositoryOwner = selfLogin ?? '';
-  let repositoryName = name;
-  for (let attempt = 0; attempt < Math.max(1, shareAttempts); attempt += 1) {
-    const result = await requestPublication({
-      apiBaseUrl, galaAccessToken, githubAccessToken, name, fetchImpl, authorize
-    });
-    if (result.ready) return result.publication;
-
-    /*
-     * The repository exists with the right content; the App installation simply cannot see it,
-     * because it is scoped to selected repositories rather than all of them. Sharing it is a click,
-     * and asking again then returns READY — the server short-circuits on a repository it can
-     * already see. The browser editor recovers the same way; without this the CLI dead-ends on a
-     * state that is one click from working.
-     *
-     * After the first attempt the repository exists, so a further refusal reports UNSUPPORTED
-     * rather than NEEDS_SHARING — the same situation under a different name.
-     */
-    const shareable = result.status === 'NEEDS_SHARING' || created;
-    if (result.status === 'NEEDS_SHARING') {
-      created = true;
-      shareUrl = installationSettingsUrl(result.installationId, result.owner, selfLogin);
-      repositoryName = result.repository ?? repositoryName;
-      repositoryOwner = result.owner ?? repositoryOwner;
-    }
-    if (!shareable || typeof ask !== 'function') throw result.failure;
-
-    notify(`${repositoryOwner}/${repositoryName} was created, but the Gala GitHub App cannot reach `
-      + 'it yet — its installation covers only selected repositories, which is the right way to '
-      + 'have it. Add this one repository to the installation; nothing else needs granting.');
-    notify(`${openUrl(shareUrl) ? 'Opened' : 'Open'} ${shareUrl}`);
-    await ask('Press enter once the App can access that repository. ');
-  }
-  throw new Error(
-    `The Gala GitHub App still cannot reach ${repositoryOwner}/${repositoryName}. Add that `
-    + `repository to the installation at ${shareUrl}, then run scaffold again.`
-  );
-}
-
-/**
- * The page that grants one repository, rather than the list of every app ever installed.
- *
- * GitHub keeps user and organisation installation settings on different paths, and only the caller
- * knows which this is: the created owner differing from the token's own account means the
- * installation lives on an organisation.
- */
-export function installationSettingsUrl(installationId, owner, selfLogin) {
-  const generic = 'https://github.com/settings/installations';
-  if (!Number.isSafeInteger(Number(installationId)) || Number(installationId) <= 0) return generic;
-  const isOrganization = typeof owner === 'string' && typeof selfLogin === 'string'
-    && owner.toLowerCase() !== selfLogin.toLowerCase();
-  return isOrganization
-    ? `https://github.com/organizations/${encodeURIComponent(owner)}/settings/installations/${installationId}`
-    : `https://github.com/settings/installations/${installationId}`;
-}
-
-async function requestPublication({
-  apiBaseUrl, galaAccessToken, githubAccessToken, name, fetchImpl, authorize
-}) {
-  const authorization = await authorize({
-    apiBaseUrl, galaAccessToken, githubAccessToken, fetchImpl
-  });
-  const response = await fetchImpl(`${String(apiBaseUrl).replace(/\/$/, '')}/v1/auth/github/publications`, {
-    method: 'POST',
-    headers: {
-      accept: 'application/json',
-      authorization: `Bearer ${galaAccessToken}`,
-      'content-type': 'application/json',
-      'GitHub-Authorization': authorization
-    },
-    body: JSON.stringify({ name })
-  });
-  if (!response.ok) throw new Error(await describeHttpFailure(response, 'Gala publication creation'));
-
-  const payload = await response.json();
-  const status = payload?.status;
-  const owner = payload?.owner;
-  const repository = payload?.name;
-
-  if (status !== 'READY') {
-    return {
-      ready: false, status, owner, repository,
-      // Carried even though the repository is not in the installation yet: it is what makes the
-      // grant a deep link rather than a hunt.
-      installationId: payload?.installationId,
-      failure: new Error(
-        `Gala could not create the publication repository (${payload?.outcome ?? status}). `
-        + 'Give the Gala GitHub App access to it at https://github.com/settings/installations, or '
-        + 'create it from https://github.com/rathnasgala/site-template yourself and run scaffold '
-        + 'with --empty-existing-repository.'
-      )
-    };
-  }
-  if (typeof owner !== 'string' || typeof repository !== 'string') {
-    throw new TypeError('Gala publication creation returned no repository identity');
-  }
-  const installationId = Number(payload?.installationId);
-  if (!Number.isSafeInteger(installationId) || installationId <= 0) {
-    throw new TypeError('Gala publication creation returned no installation');
-  }
-
-  return { ready: true, status, owner, repository, publication: Object.freeze({
-    owner,
-    repository,
-    installationId,
-    outcome: payload?.outcome ?? null,
-    // The server names the repository it actually made, which may differ from what was asked for.
-    fullName: `${owner}/${repository}`,
-    cloneUrl: `https://github.com/${owner}/${repository}.git`
-  }) };
-}

package/src/publication-state.js

@@ -1,7 +0,0 @@
-import {
-  PUBLICATION_STATE_PATH,
-  readPublicationState,
-  recordSuccessfulDeployment
-} from '@rathnasgala/content-validation';
-
-export { PUBLICATION_STATE_PATH, readPublicationState, recordSuccessfulDeployment };

package/src/publish-command.js

@@ -1,37 +0,0 @@
-import path from 'node:path';
-import { spawn } from 'node:child_process';
-import { regenerateBuildManifest } from './validate-command.js';
-
-export async function publishSite({
-  root,
-  today,
-  force = false,
-  spawnProcess = spawn,
-  warn = (message) => process.stderr.write(`${message}\n`)
-}) {
-  const siteRoot = path.resolve(root);
-  if (!force) {
-    const { results } = await regenerateBuildManifest({ root: siteRoot, today });
-    const failures = results.filter(({ errors }) => errors.length > 0);
-    if (failures.length > 0) {
-      throw new Error(`Publish refused: ${failures.length} post variant(s) failed validation`);
-    }
-    for (const result of results) {
-      for (const warning of result.warnings) warn(`${result.file}: warning: ${warning}`);
-    }
-  }
-
-  return new Promise((resolve, reject) => {
-    const child = spawnProcess('git', ['-C', siteRoot, 'push'], {
-      cwd: siteRoot,
-      shell: false,
-      stdio: 'inherit'
-    });
-    child.once('error', reject);
-    child.once('exit', (code, signal) => {
-      if (signal) reject(new Error(`Publish terminated by signal ${signal}`));
-      else if (code !== 0) reject(new Error(`Git push exited with code ${code}`));
-      else resolve();
-    });
-  });
-}