@stringsync/splates 0.0.60 → 1.13.3

package/vendor/core/ship/index.js

@@ -0,0 +1,3203 @@
+// ship/bundle/published.ts
+var LOCAL = new Set([
+  "devDependencies",
+  "scripts",
+  "files",
+  "private",
+  "workspaces",
+  "trustedDependencies",
+  "main",
+  "module",
+  "types",
+  "exports",
+  "bin"
+]);
+var WORKSPACE = /^workspace:/;
+var CATALOG = /^catalog:/;
+var SOURCE = /\.tsx?$/;
+function published(manifest, opts = {}) {
+  const version = manifest.version;
+  if (version === undefined) {
+    throw new Error(`${manifest.name ?? "a package"} has no version to publish`);
+  }
+  const out = {};
+  for (const [field, value] of Object.entries(manifest)) {
+    if (!LOCAL.has(field)) {
+      out[field] = value;
+    }
+  }
+  const main = built(entry(manifest.exports, ".") ?? manifest.module);
+  if (main !== undefined) {
+    out.main = main;
+    out.types = types(main);
+  }
+  if (manifest.exports !== undefined) {
+    out.exports = conditions(manifest.exports);
+  }
+  if (manifest.bin !== undefined) {
+    out.bin = typeof manifest.bin === "string" ? built(manifest.bin) ?? manifest.bin : Object.fromEntries(Object.entries(manifest.bin).map(([name, path]) => [
+      name,
+      built(path) ?? path
+    ]));
+  }
+  for (const field of ["dependencies", "peerDependencies"]) {
+    const deps = manifest[field];
+    if (deps !== undefined) {
+      out[field] = ranges(manifest.name, deps, version, opts);
+    }
+  }
+  return out;
+}
+function conditions(exports) {
+  if (typeof exports === "string") {
+    const main = built(exports);
+    return main === undefined ? exports : { types: types(main), default: main };
+  }
+  return Object.fromEntries(Object.entries(exports).map(([key, value]) => [key, conditions(value)]));
+}
+function built(path) {
+  return path !== undefined && SOURCE.test(path) ? path.replace(SOURCE, ".js") : undefined;
+}
+function types(path) {
+  return path.replace(/\.js$/, ".d.ts");
+}
+function entry(exports, key) {
+  if (exports === undefined) {
+    return;
+  }
+  if (typeof exports === "string") {
+    return key === "." ? exports : undefined;
+  }
+  const found = exports[key];
+  return typeof found === "string" ? found : undefined;
+}
+function ranges(name, deps, version, opts) {
+  return Object.fromEntries(Object.entries(deps).map(([dep, range]) => {
+    if (WORKSPACE.test(range)) {
+      return [dep, `^${opts.versions?.[dep] ?? version}`];
+    }
+    if (CATALOG.test(range)) {
+      const given = opts.catalog?.[dep];
+      if (given === undefined) {
+        throw new Error(`${name ?? "a package"} takes ${dep} from the catalog, which has no ${dep}`);
+      }
+      return [dep, given];
+    }
+    return [dep, range];
+  }));
+}
+// ship/bundle/vendor-bundle.ts
+import { dirname as dirname3, relative } from "node:path";
+import { NodeFs as NodeFs3, NodePs as NodePs3, walk as walk2 } from "../system/index.js";
+
+// ship/workspace/manifest-workspace.ts
+import { dirname } from "node:path";
+import { NodeFs, NodePs } from "../system/index.js";
+
+class ManifestWorkspace {
+  root;
+  fs;
+  ps;
+  project;
+  constructor(root, opts = {}) {
+    this.root = root;
+    this.fs = opts.fs ?? new NodeFs;
+    this.ps = opts.ps ?? new NodePs;
+    this.project = opts.project;
+  }
+  static async at(from, opts = {}) {
+    const fs = opts.fs ?? new NodeFs;
+    let single = null;
+    for (let dir = from;; dir = dirname(dir)) {
+      const manifest = await read(fs, dir);
+      if (manifest?.workspaces !== undefined) {
+        return new ManifestWorkspace(dir, { ...opts, fs });
+      }
+      if (single === null && manifest?.name !== undefined) {
+        single = dir;
+      }
+      if (dirname(dir) === dir) {
+        if (single === null) {
+          throw new Error(`no workspace above ${from}`);
+        }
+        return new ManifestWorkspace(single, { ...opts, fs });
+      }
+    }
+  }
+  async version() {
+    if (this.project !== undefined) {
+      for (const dir of await this.dirs()) {
+        const version = (await read(this.fs, dir))?.version;
+        if (version !== undefined) {
+          return version;
+        }
+      }
+      return "0.0.0";
+    }
+    return (await this.manifest()).version ?? "0.0.0";
+  }
+  async packages() {
+    const found = [];
+    for (const dir of await this.dirs()) {
+      const manifest = await read(this.fs, dir);
+      if (manifest?.name !== undefined) {
+        found.push({ dir, manifest: { ...manifest, name: manifest.name } });
+      }
+    }
+    const names = new Set(found.map((one) => one.manifest.name));
+    return found.map(({ dir, manifest }) => ({
+      name: manifest.name,
+      dir,
+      private: manifest.private === true,
+      dependencies: Object.keys({
+        ...manifest.dependencies,
+        ...manifest.peerDependencies
+      }).filter((dep) => names.has(dep)),
+      ...repositoryOf(manifest)
+    })).sort((left, right) => left.name.localeCompare(right.name));
+  }
+  async setVersion(version) {
+    const dirs = (await this.dirs()).filter((dir) => dir !== this.root);
+    for (const dir of dirs) {
+      await this.stamp(dir, version);
+    }
+    await this.lock();
+    if (this.project === undefined) {
+      await this.stamp(this.root, version);
+    }
+  }
+  async dirs() {
+    const declared = (await this.manifest()).workspaces;
+    const workspaces = Array.isArray(declared) ? declared : declared?.packages;
+    if (workspaces === undefined) {
+      return [this.root];
+    }
+    const dirs = [];
+    for (const pattern of workspaces) {
+      dirs.push(...await this.expand(this.root, pattern.split("/")));
+    }
+    if (this.project === undefined) {
+      const root = await this.manifest();
+      const published = root.name !== undefined && root.private !== true;
+      return published && !dirs.includes(this.root) ? [this.root, ...dirs] : dirs;
+    }
+    return dirs.filter((dir) => dir.startsWith(`${this.root}/${this.project}/`));
+  }
+  async expand(dir, segments) {
+    const [head, ...rest] = segments;
+    if (head === undefined) {
+      return [dir];
+    }
+    if (head !== "*") {
+      return this.expand(`${dir}/${head}`, rest);
+    }
+    const found = [];
+    for (const entry of await this.fs.readdir(dir).catch(() => [])) {
+      found.push(...await this.expand(`${dir}/${entry}`, rest));
+    }
+    return found;
+  }
+  async lock() {
+    if (!await this.fs.exists(`${this.root}/bun.lock`)) {
+      return;
+    }
+    const { exitCode, stdout, stderr } = await this.ps.spawnCapture(["bun", "install", "--lockfile-only"], { cwd: this.root });
+    if (exitCode !== 0) {
+      throw new Error(`bun install --lockfile-only: ${stderr.trim() || stdout.trim()}`);
+    }
+  }
+  async manifest() {
+    return await read(this.fs, this.root) ?? {};
+  }
+  async stamp(dir, version) {
+    const path = `${dir}/package.json`;
+    const manifest = await read(this.fs, dir);
+    if (manifest === null) {
+      return;
+    }
+    manifest.version = version;
+    await this.fs.write(path, `${JSON.stringify(manifest, null, "\t")}
+`);
+  }
+}
+async function read(fs, dir) {
+  try {
+    return JSON.parse(await fs.read(`${dir}/package.json`));
+  } catch {
+    return null;
+  }
+}
+function repositoryOf(manifest) {
+  const { repository } = manifest;
+  const url = typeof repository === "string" ? repository : repository?.url;
+  return url === undefined ? {} : { repository: url };
+}
+
+// ship/bundle/bun-bundle.ts
+import {
+  NodeFs as NodeFs2,
+  NodeGlob,
+  NodePs as NodePs2,
+  walk
+} from "../system/index.js";
+
+// ship/bundle/reach.ts
+import { builtinModules } from "node:module";
+import { dirname as dirname2, resolve as resolvePath } from "node:path";
+var SPECIFIER = /\b(from|import)(\s*\(?\s*)"([^"]+)"/g;
+var SOURCE_SPECIFIER = /\b(from|import)(\s*\(?\s*)(["'])([^"'\n]+)\3/g;
+var SOURCE2 = /\.tsx?$/;
+var PACKAGE_NAME = /^(@[a-z0-9~-][a-z0-9._~-]*\/)?[a-z0-9~-][a-z0-9._~-]*$/;
+function keyOf(pkg, exported, specifier) {
+  const key = `.${specifier.slice(pkg.name.length)}`;
+  if (!exported.has(key)) {
+    throw new Error(`${pkg.name} exports no "${key}", imported as "${specifier}"`);
+  }
+  return key;
+}
+async function reach(fs, pkg, keys) {
+  const manifest = await manifestAt(fs, pkg.dir);
+  const exported = entries(manifest.exports ?? {});
+  const found = new Set;
+  const seen = new Set;
+  const queue = [...keys];
+  while (queue.length > 0) {
+    const key = queue.pop();
+    if (found.has(key)) {
+      continue;
+    }
+    found.add(key);
+    const files = [`${pkg.dir}/${exported.get(key).slice(2)}`];
+    while (files.length > 0) {
+      const file = files.pop();
+      if (seen.has(file) || file.endsWith(".test.ts")) {
+        continue;
+      }
+      seen.add(file);
+      for (const specifier of await specifiers(file, fs)) {
+        if (isPackage(specifier, pkg.name)) {
+          queue.push(keyOf(pkg, exported, specifier));
+        } else if (specifier.startsWith(".")) {
+          const next = await resolve(fs, resolvePath(dirname2(file), specifier));
+          if (next !== undefined) {
+            files.push(next);
+          }
+        }
+      }
+    }
+  }
+  return { keys: found, files: seen };
+}
+async function resolve(fs, path) {
+  const candidates = SOURCE2.test(path) ? [path] : [`${path}.ts`, `${path}.tsx`, `${path}/index.ts`, `${path}/index.tsx`];
+  for (const candidate of candidates) {
+    if (await fs.exists(candidate)) {
+      return candidate;
+    }
+  }
+  return;
+}
+function isPackage(specifier, name) {
+  return specifier === name || specifier.startsWith(`${name}/`);
+}
+function outsider(specifier) {
+  if (specifier.startsWith(".") || specifier.startsWith("node:") || specifier.startsWith("bun:") || specifier === "bun") {
+    return;
+  }
+  const parts = specifier.split("/");
+  const name = specifier.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+  return name === undefined || !PACKAGE_NAME.test(name) || builtinModules.includes(name) ? undefined : name;
+}
+async function specifiers(path, fs) {
+  const text = await fs.read(path);
+  return [...text.matchAll(SOURCE_SPECIFIER)].map((match) => match[4]);
+}
+function entries(exports) {
+  const found = new Map;
+  if (typeof exports === "string") {
+    return found.set(".", exports);
+  }
+  for (const [key, value] of Object.entries(exports)) {
+    const path = pathOf(value);
+    if (path !== undefined) {
+      found.set(key, path);
+    }
+  }
+  return found;
+}
+function pathOf(exports) {
+  if (typeof exports === "string") {
+    return exports;
+  }
+  for (const value of Object.values(exports)) {
+    const path = pathOf(value);
+    if (path !== undefined) {
+      return path;
+    }
+  }
+  return;
+}
+async function manifestAt(fs, dir) {
+  return JSON.parse(await fs.read(`${dir}/package.json`));
+}
+async function catalogAt(fs, root) {
+  const manifest = await manifestAt(fs, root);
+  const nested = Array.isArray(manifest.workspaces) ? undefined : manifest.workspaces?.catalog;
+  return { ...manifest.catalog, ...nested };
+}
+
+// ship/bundle/bun-bundle.ts
+var SPECIFIER2 = /(from\s*"|import\(")(\.[^"]*)(")/g;
+var EXTENSION = /\.[a-z]+$/;
+var SOURCE3 = /\.tsx?$/;
+var DOCS = ["README.md", "LICENSE", "LICENSE.md", "CHANGELOG.md"];
+
+class BunBundle {
+  fs;
+  ps;
+  glob;
+  constructor(opts = {}) {
+    this.fs = opts.fs ?? new NodeFs2;
+    this.ps = opts.ps ?? new NodePs2;
+    this.glob = opts.glob ?? new NodeGlob;
+  }
+  async build(dir) {
+    const manifest = JSON.parse(await this.fs.read(`${dir}/package.json`));
+    const out = `${dir}/dist`;
+    if (manifest.scripts?.build !== undefined) {
+      await this.run(["bun", "run", "build"], dir);
+    }
+    await this.compile(dir, sources(manifest));
+    await this.fs.mkdir(out);
+    await this.point(dir);
+    await this.fs.write(`${out}/package.json`, `${JSON.stringify(published(manifest, await this.resolving(dir, manifest)), null, "\t")}
+`);
+    for (const doc of DOCS) {
+      if (await this.fs.exists(`${dir}/${doc}`)) {
+        await this.fs.write(`${out}/${doc}`, await this.fs.read(`${dir}/${doc}`));
+      }
+    }
+    await this.copy(dir, manifest.files ?? []);
+    return out;
+  }
+  async resolving(dir, manifest) {
+    const ranges = Object.values({
+      ...manifest.dependencies,
+      ...manifest.peerDependencies
+    });
+    if (!ranges.some((range) => /^(workspace|catalog):/.test(range))) {
+      return {};
+    }
+    const workspace = await ManifestWorkspace.at(dir, {
+      fs: this.fs,
+      ps: this.ps
+    });
+    const versions = {};
+    for (const pkg of await workspace.packages()) {
+      const { version } = await manifestAt(this.fs, pkg.dir);
+      if (version !== undefined) {
+        versions[pkg.name] = version;
+      }
+    }
+    return { versions, catalog: await catalogAt(this.fs, workspace.root) };
+  }
+  async clean(dir) {
+    await this.fs.rm(`${dir}/dist`, { recursive: true, force: true });
+  }
+  async copy(dir, patterns) {
+    if (patterns.length === 0) {
+      return;
+    }
+    const out = `${dir}/dist`;
+    for await (const path of walk(dir, { fs: this.fs })) {
+      if (path.startsWith(`${out}/`)) {
+        continue;
+      }
+      const relative = path.slice(dir.length + 1);
+      if (patterns.some((pattern) => this.glob.matches(pattern, relative))) {
+        await this.fs.mkdir(`${out}/${relative}`.replace(/\/[^/]*$/, ""));
+        await this.fs.writeBytes(`${out}/${relative}`, await this.fs.readBytes(path));
+      }
+    }
+  }
+  async compile(dir, entries, outdir = "dist") {
+    if (entries.length === 0) {
+      return;
+    }
+    await this.run([
+      "bun",
+      "build",
+      ...entries,
+      "--outdir",
+      outdir,
+      "--root",
+      ".",
+      "--target",
+      "node",
+      "--packages",
+      "external",
+      "--splitting"
+    ], dir);
+    await this.run([
+      "bunx",
+      "tsc",
+      "--ignoreConfig",
+      "--emitDeclarationOnly",
+      "--declaration",
+      "--outDir",
+      outdir,
+      "--rootDir",
+      ".",
+      "--module",
+      "preserve",
+      "--moduleResolution",
+      "bundler",
+      "--target",
+      "esnext",
+      "--lib",
+      "esnext,dom",
+      "--types",
+      "bun",
+      "--strict",
+      "--skipLibCheck",
+      ...entries,
+      ...await this.ambient(dir)
+    ], dir);
+  }
+  async ambient(dir) {
+    const entries = await this.fs.readdir(dir);
+    return entries.filter((entry) => entry.endsWith(".d.ts")).map((entry) => `./${entry}`);
+  }
+  async point(dir) {
+    for await (const path of walk(`${dir}/dist`, { fs: this.fs })) {
+      if (!path.endsWith(".d.ts")) {
+        continue;
+      }
+      const before = await this.fs.read(path);
+      const after = before.replace(SPECIFIER2, (match, head, specifier, tail) => EXTENSION.test(specifier) ? match : `${head}${specifier}.js${tail}`);
+      if (after !== before) {
+        await this.fs.write(path, after);
+      }
+    }
+  }
+  async run(argv, cwd) {
+    const { exitCode } = await this.ps.spawn(argv, { cwd });
+    if (exitCode !== 0) {
+      throw new Error(`\`${argv.join(" ")}\` failed in ${cwd}`);
+    }
+  }
+}
+function sources(manifest) {
+  const found = new Set;
+  const gather = (entry) => {
+    if (typeof entry === "string") {
+      if (SOURCE3.test(entry)) {
+        found.add(entry);
+      }
+      return;
+    }
+    for (const value of Object.values(entry)) {
+      gather(value);
+    }
+  };
+  gather(manifest.exports ?? {});
+  gather(manifest.bin ?? {});
+  return [...found];
+}
+
+// ship/bundle/vendor-bundle.ts
+var NEVER = ["scry", "vet"];
+
+class VendorBundle {
+  opts;
+  fs;
+  ps;
+  bundle;
+  constructor(opts = {}) {
+    this.opts = opts;
+    this.fs = opts.fs ?? new NodeFs3;
+    this.ps = opts.ps ?? new NodePs3;
+    this.bundle = opts.bundle ?? new BunBundle({ fs: this.fs, ps: this.ps });
+  }
+  async build(dir) {
+    const source = await manifestAt(this.fs, dir);
+    const workspace = this.opts.workspace ?? await ManifestWorkspace.at(dir, { fs: this.fs, ps: this.ps });
+    const private_ = (await workspace.packages()).filter((pkg) => pkg.private);
+    const vendored = private_.filter((pkg) => source.dependencies?.[pkg.name]?.startsWith("workspace:"));
+    const never = this.opts.never ?? NEVER;
+    for (const pkg of vendored) {
+      if (never.includes(pkg.name)) {
+        throw new Error(`${source.name} depends on ${pkg.name}, which stays in the repository and cannot be vendored`);
+      }
+    }
+    const out = await this.bundle.build(dir);
+    if (vendored.length === 0) {
+      return out;
+    }
+    const catalog = await catalogAt(this.fs, workspace.root);
+    const published = await manifestAt(this.fs, out);
+    for (const pkg of vendored) {
+      delete published.dependencies?.[pkg.name];
+      await this.vendor(pkg, out, published, catalog);
+    }
+    await this.fs.write(`${out}/package.json`, `${JSON.stringify(published, null, "\t")}
+`);
+    return out;
+  }
+  async clean(dir) {
+    await this.bundle.clean(dir);
+  }
+  async vendor(pkg, out, published, catalog) {
+    const manifest = await manifestAt(this.fs, pkg.dir);
+    const exported = entries(manifest.exports ?? {});
+    const root = `${out}/vendor/${pkg.name}`;
+    const names = (path) => specifiers(path, this.fs);
+    const wanted = new Set;
+    for (const path of await this.built(out)) {
+      for (const specifier of await names(path)) {
+        if (isPackage(specifier, pkg.name)) {
+          wanted.add(keyOf(pkg, exported, specifier));
+        }
+      }
+    }
+    const reached = (await reach(this.fs, pkg, [...wanted])).keys;
+    if (reached.size === 0) {
+      return;
+    }
+    const sources = [...reached].map((key) => exported.get(key));
+    await this.bundle.compile(pkg.dir, sources, root);
+    const where = new Map([...reached].map((key) => [
+      key === "." ? pkg.name : `${pkg.name}/${key.slice(2)}`,
+      `${root}/${exported.get(key).replace(SOURCE2, ".js")}`
+    ]));
+    for (const path of await this.built(out)) {
+      const before = await this.fs.read(path);
+      const after = before.replace(SPECIFIER, (match, head, gap, specifier) => {
+        const target = isPackage(specifier, pkg.name) ? where.get(specifier) : undefined;
+        if (target === undefined) {
+          return match;
+        }
+        const next = relative(dirname3(path), target);
+        return `${head}${gap}"${next.startsWith(".") ? next : `./${next}`}"`;
+      });
+      if (after !== before) {
+        await this.fs.write(path, after);
+      }
+    }
+    const needed = new Set;
+    for await (const path of walk2(root, { fs: this.fs })) {
+      if (!/\.(js|d\.ts)$/.test(path)) {
+        continue;
+      }
+      for (const specifier of await names(path)) {
+        const outside = outsider(specifier);
+        if (outside !== undefined) {
+          needed.add(outside);
+        }
+      }
+    }
+    this.declare(pkg.name, manifest, published, catalog, needed);
+    for (const doc of ["LICENSE", "LICENSE.md"]) {
+      if (await this.fs.exists(`${pkg.dir}/${doc}`)) {
+        await this.fs.write(`${root}/${doc}`, await this.fs.read(`${pkg.dir}/${doc}`));
+      }
+    }
+  }
+  async built(out) {
+    const found = [];
+    for await (const path of walk2(out, { fs: this.fs })) {
+      if (/\.(js|d\.ts)$/.test(path)) {
+        found.push(path);
+      }
+    }
+    return found.toSorted();
+  }
+  declare(vendored, manifest, published, catalog, needed) {
+    for (const name of [...needed].toSorted()) {
+      if (published.dependencies?.[name] !== undefined || published.peerDependencies?.[name] !== undefined) {
+        continue;
+      }
+      const field = manifest.dependencies?.[name] !== undefined ? "dependencies" : manifest.peerDependencies?.[name] !== undefined ? "peerDependencies" : undefined;
+      if (field === undefined) {
+        throw new Error(`${vendored} imports ${name}, which it does not declare`);
+      }
+      const range = manifest[field]?.[name];
+      const resolved = range.startsWith("catalog:") ? catalog[name] : range;
+      if (resolved === undefined || resolved.startsWith("workspace:")) {
+        throw new Error(`${vendored} declares ${name} as ${range}, which no registry can resolve`);
+      }
+      published[field] = { ...published[field], [name]: resolved };
+      const meta = manifest.peerDependenciesMeta?.[name];
+      if (field === "peerDependencies" && meta !== undefined) {
+        published.peerDependenciesMeta = {
+          ...published.peerDependenciesMeta,
+          [name]: meta
+        };
+      }
+    }
+  }
+}
+// ship/cut.ts
+import { ConsoleLogger } from "../log/index.js";
+
+class Cut {
+  version;
+  packages;
+  tag;
+  log;
+  root;
+  dryRun;
+  staged = new Map;
+  constructor(version, packages, opts = {}) {
+    this.version = version;
+    this.packages = packages;
+    this.tag = `v${version}`;
+    this.log = opts.log ?? new ConsoleLogger;
+    this.root = opts.root ?? ".";
+    this.dryRun = opts.dryRun;
+  }
+  dir(name) {
+    const pkg = this.packages.find((one) => one.name === name);
+    return pkg === undefined ? undefined : this.staged.get(name) ?? pkg.dir;
+  }
+  stage(name, dir) {
+    this.staged.set(name, dir);
+  }
+}
+// ship/mirror/mirror-build.ts
+import { join as join2, relative as relative4 } from "node:path";
+import { color as color2 } from "../log/index.js";
+import { NodeFs as NodeFs6, NodePs as NodePs6 } from "../system/index.js";
+import { Duration as Duration2 } from "../time/index.js";
+
+// ship/git/cli-git.ts
+import { NodePs as NodePs4 } from "../system/index.js";
+
+class CliGit {
+  root;
+  ps;
+  constructor(root, opts = {}) {
+    this.root = root;
+    this.ps = opts.ps ?? new NodePs4;
+  }
+  async clean() {
+    return await this.out("status", "--porcelain") === "";
+  }
+  branch() {
+    return this.out("rev-parse", "--abbrev-ref", "HEAD");
+  }
+  head() {
+    return this.out("rev-parse", "HEAD");
+  }
+  async defaultBranch() {
+    const head = await this.run("symbolic-ref", "--short", "refs/remotes/origin/HEAD");
+    return head.exitCode === 0 ? head.stdout.trim().replace(/^origin\//, "") : "main";
+  }
+  async discard() {
+    await this.out("checkout", "HEAD", "--", ":/");
+  }
+  async commitAll(message) {
+    if (await this.clean()) {
+      return;
+    }
+    await this.out("commit", "--all", "--message", message);
+  }
+  async tag(tag) {
+    const { exitCode } = await this.run("rev-parse", "--verify", "--quiet", `refs/tags/${tag}`);
+    if (exitCode === 0) {
+      return;
+    }
+    await this.out("tag", tag);
+  }
+  async push(ref) {
+    await this.out("push", "origin", ref);
+  }
+  async remoteTags(pattern) {
+    const out = await this.out("ls-remote", "--tags", "--refs", "origin", pattern);
+    return out.split(`
+`).filter((line) => line !== "").map((line) => line.replace(/^\S+\trefs\/tags\//, ""));
+  }
+  run(...args) {
+    return this.ps.spawnCapture(["git", "-C", this.root, ...args]);
+  }
+  async out(...args) {
+    const { exitCode, stdout, stderr } = await this.run(...args);
+    if (exitCode !== 0) {
+      throw new Error(`git ${args.join(" ")}: ${stderr.trim() || stdout.trim()}`);
+    }
+    return stdout.trim();
+  }
+}
+
+// ship/publish-workflow.ts
+import { dirname as dirname4, resolve as resolve2 } from "node:path";
+import { NodeFs as NodeFs4 } from "../system/index.js";
+var PUBLISH_WORKFLOW_PATH = ".github/workflows/webappwiz-publish.yml";
+
+class PublishWorkflow {
+  command;
+  fs;
+  constructor(opts) {
+    this.command = opts.command;
+    this.fs = opts.fs ?? new NodeFs4;
+  }
+  text() {
+    return `# Generated by webappwiz; do not edit. A release rewrites it when it is stale.
+# npm's trusted publisher entries name this file, so keep its path.
+name: webappwiz publish
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: The release commit to publish
+        required: true
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: \${{ inputs.ref }}
+      - uses: oven-sh/setup-bun@v2
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+      - run: npm install -g npm@latest
+      - run: bun install --frozen-lockfile
+      - run: ${this.command}
+`;
+  }
+  async drift(root) {
+    const path = resolve2(root, PUBLISH_WORKFLOW_PATH);
+    if (!await this.fs.exists(path)) {
+      return "missing";
+    }
+    return await this.fs.read(path) === this.text() ? undefined : "stale";
+  }
+  async write(root) {
+    if (await this.drift(root) === undefined) {
+      return false;
+    }
+    const path = resolve2(root, PUBLISH_WORKFLOW_PATH);
+    await this.fs.mkdir(dirname4(path), { recursive: true });
+    await this.fs.write(path, this.text());
+    return true;
+  }
+  async check(root) {
+    const drift = await this.drift(root);
+    if (drift !== undefined) {
+      throw new Error(`${PUBLISH_WORKFLOW_PATH} is ${drift}: run a release to regenerate it, and commit it`);
+    }
+  }
+}
+
+// ship/mirror/mirror-step.ts
+import { tmpdir } from "node:os";
+import { dirname as dirname6, join, relative as relative3 } from "node:path";
+import { color } from "../log/index.js";
+import {
+  NodeFs as NodeFs5,
+  NodeGlob as NodeGlob2,
+  NodePs as NodePs5
+} from "../system/index.js";
+import { Duration } from "../time/index.js";
+
+// ship/mirror/agent-files.ts
+var AGENT_FILES = [
+  "**/AGENTS.md",
+  "**/CLAUDE.md",
+  "**/.claude/**",
+  "**/.agents/**",
+  "skills/**",
+  "splates.config.ts",
+  "SPLATES.md"
+];
+
+// ship/mirror/mirror-guard.ts
+var TRAILER = "Mirrored-from";
+async function guard(ps, mirror, project, adopt) {
+  const git = async (...args) => {
+    const result = await ps.spawnCapture(["git", ...args], { cwd: mirror });
+    if (result.exitCode !== 0) {
+      throw new Error(`git ${args.join(" ")} failed: ${result.stderr.trim()}`);
+    }
+    return result.stdout.trim();
+  };
+  const head = await ps.spawnCapture(["git", "rev-parse", "HEAD"], {
+    cwd: mirror
+  });
+  if (head.exitCode !== 0) {
+    return;
+  }
+  const last = await git("log", "--first-parent", "--max-count=1", "--format=%H", "--extended-regexp", `--grep=^${TRAILER}: [0-9a-f]{40}$`, `--grep=^Mirror ${escapeRegExp(project)} at `);
+  const from = last !== "" ? last : adopt;
+  if (from === undefined) {
+    throw new Error(`${project}'s remote has commits but none is a mirror commit; name the commit the mirror takes over from with \`adopt\` to take it over on purpose`);
+  }
+  const known = await ps.spawnCapture(["git", "cat-file", "-e", `${from}^{commit}`], { cwd: mirror });
+  if (known.exitCode !== 0) {
+    throw new Error(`${project} adopts ${from}, which the remote branch does not hold`);
+  }
+  const foreign = await git("log", "--format=%h %an %s", `${from}..HEAD`);
+  if (foreign !== "") {
+    throw new Error(`${project}'s remote has commits the mirror did not make, which this run would revert:
+${foreign}
+Import them into mono, or drop them from the remote on purpose, then ship again`);
+  }
+}
+function escapeRegExp(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// ship/mirror/mirror-tooling.ts
+import { dirname as dirname5, relative as relative2 } from "node:path";
+
+class MirrorTooling {
+  opts;
+  constructor(opts) {
+    this.opts = opts;
+  }
+  get fs() {
+    return this.opts.fs;
+  }
+  get ps() {
+    return this.opts.ps;
+  }
+  async tsconfigs(dir, files) {
+    for (const path of files) {
+      if (!path.endsWith("/tsconfig.json")) {
+        continue;
+      }
+      const base = relative2(dirname5(path), dir) || ".";
+      const before = await this.fs.read(path);
+      const after = before.replace(/("extends"\s*:\s*")(?:\.\.\/)+(tsconfig\.base\.json")/g, `$1${base}/$2`);
+      if (after !== before) {
+        await this.fs.write(path, after);
+      }
+    }
+  }
+  async gitignore(root, mirror) {
+    const own = `${mirror}/.gitignore`;
+    const base = await this.fs.exists(`${root}/.gitignore`) ? (await this.fs.read(`${root}/.gitignore`)).split(`
+`).flatMap((line) => this.rooted(line)).join(`
+`) : `node_modules
+dist
+*.tgz
+`;
+    const theirs = await this.fs.exists(own) ? await this.fs.read(own) : "";
+    await this.fs.write(own, theirs === "" ? base : `${base.trimEnd()}
+
+${theirs}`);
+  }
+  rooted(line) {
+    const negated = line.startsWith("!");
+    const pattern = (negated ? line.slice(1) : line).replace(/^\//, "");
+    const prefix = `${this.opts.project}/`;
+    if (pattern.startsWith(prefix)) {
+      return [`${negated ? "!" : ""}${pattern.slice(prefix.length)}`];
+    }
+    const anchored = pattern.replace(/\/$/, "").includes("/") && !pattern.startsWith("**/") && !line.trimStart().startsWith("#");
+    return anchored ? [] : [line];
+  }
+  async bunfig(root, mirror) {
+    if (!await this.fs.exists(`${root}/bunfig.toml`)) {
+      return;
+    }
+    const base = await this.fs.read(`${root}/bunfig.toml`);
+    const own = `${mirror}/bunfig.toml`;
+    if (!await this.fs.exists(own)) {
+      await this.fs.write(own, base);
+      return;
+    }
+    const mine = await this.fs.read(own);
+    const clash = tables(base).filter((table) => tables(mine).includes(table));
+    if (clash.length > 0) {
+      throw new Error(`${this.opts.project} and the root both set [${clash[0]}] in bunfig.toml`);
+    }
+    await this.fs.write(own, `${base.trimEnd()}
+
+${mine}`);
+  }
+  async lint(root, mirror, source) {
+    if (!await this.fs.exists(`${root}/biome.json`)) {
+      return;
+    }
+    const base = JSON.parse(await this.fs.read(`${root}/biome.json`));
+    if (Array.isArray(base.overrides)) {
+      base.overrides = this.overrides(base.overrides);
+    }
+    const own = `${mirror}/biome.json`;
+    let config = base;
+    if (await this.fs.exists(own)) {
+      const {
+        root: _root,
+        extends: _extends,
+        ...rest
+      } = JSON.parse(await this.fs.read(own));
+      config = merge(base, rest);
+    }
+    config.files = {
+      ...config.files,
+      includes: [...config.files?.includes ?? ["**"], `!${source}`]
+    };
+    await this.fs.write(own, `${JSON.stringify(config, null, "\t")}
+`);
+    await this.format(root, mirror, ["biome.json"]);
+  }
+  overrides(overrides) {
+    const prefix = `${this.opts.project}/`;
+    const out = [];
+    for (const override of overrides) {
+      if (!isObject(override) || !Array.isArray(override.includes)) {
+        out.push(override);
+        continue;
+      }
+      const includes = [];
+      for (const include of override.includes) {
+        const negated = include.startsWith("!");
+        const path = negated ? include.slice(1) : include;
+        if (path.startsWith("*")) {
+          includes.push(include);
+        } else if (path.startsWith(prefix)) {
+          includes.push(`${negated ? "!" : ""}${path.slice(prefix.length)}`);
+        }
+      }
+      if (includes.some((include) => !include.startsWith("!"))) {
+        out.push({ ...override, includes });
+      }
+    }
+    return out;
+  }
+  async format(root, mirror, paths) {
+    const biome = `${root}/node_modules/.bin/biome`;
+    if (!await this.fs.exists(biome)) {
+      return;
+    }
+    const result = await this.ps.spawnCapture([biome, "format", "--write", ...paths], { cwd: mirror });
+    if (result.exitCode !== 0) {
+      throw new Error(`biome format failed in ${mirror}: ${result.stderr.trim()}`);
+    }
+  }
+}
+function merge(base, over) {
+  if (isObject(base) && isObject(over)) {
+    const out = { ...base };
+    for (const [key, value] of Object.entries(over)) {
+      out[key] = key in base ? merge(base[key], value) : value;
+    }
+    return out;
+  }
+  return over;
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function tables(toml) {
+  return [...toml.matchAll(/^\s*\[([^\]]+)\]\s*$/gm)].map((match) => match[1]);
+}
+
+// ship/mirror/source-manifest.ts
+var FIELDS = [
+  "dependencies",
+  "peerDependencies",
+  "devDependencies"
+];
+async function sourceManifest(fs, core, { keys, files, catalog, version }) {
+  const manifest = await manifestAt(fs, core.dir);
+  const exported = entries(manifest.exports ?? {});
+  const out = {
+    name: core.name,
+    version,
+    private: true,
+    type: "module",
+    exports: Object.fromEntries([...keys].toSorted().map((key) => [key, exported.get(key)]))
+  };
+  if (typeof manifest.license === "string") {
+    out.license = manifest.license;
+  }
+  const needed = new Set;
+  for (const file of files) {
+    for (const specifier of await specifiers(file, fs)) {
+      const outside = outsider(specifier);
+      if (outside !== undefined && outside !== core.name) {
+        needed.add(outside);
+      }
+    }
+  }
+  for (const name of [...needed].toSorted()) {
+    const field = FIELDS.find((one) => manifest[one]?.[name] !== undefined);
+    if (field === undefined) {
+      throw new Error(`${core.name} imports ${name}, which it does not declare`);
+    }
+    const range = manifest[field]?.[name];
+    const resolved = range.startsWith("catalog:") ? catalog[name] : range;
+    if (resolved === undefined || resolved.startsWith("workspace:")) {
+      throw new Error(`${core.name} declares ${name} as ${range}, which no registry can resolve`);
+    }
+    out[field] = { ...out[field], [name]: resolved };
+    const meta = manifest.peerDependenciesMeta?.[name];
+    if (field === "peerDependencies" && meta !== undefined) {
+      out.peerDependenciesMeta = {
+        ...out.peerDependenciesMeta,
+        [name]: meta
+      };
+    }
+    const types = typesOf(name);
+    const typed = manifest.devDependencies?.[types];
+    if (typed !== undefined) {
+      const resolvedTypes = typed.startsWith("catalog:") ? catalog[types] : typed;
+      if (resolvedTypes === undefined) {
+        throw new Error(`${types} is ${typed}, which the catalog lacks`);
+      }
+      out.devDependencies = {
+        ...out.devDependencies,
+        [types]: resolvedTypes
+      };
+    }
+  }
+  return out;
+}
+function typesOf(name) {
+  return `@types/${name.startsWith("@") ? name.slice(1).replace("/", "__") : name}`;
+}
+
+// ship/mirror/mirror-step.ts
+var NEVER2 = ["scry", "vet"];
+var SKIPPED = new Set([".git", "node_modules", "dist"]);
+var SOURCE_DIR = "packages";
+
+class MirrorStep {
+  opts;
+  name;
+  deadline = Duration.mins(5);
+  stage = "tag";
+  fs;
+  ps;
+  glob;
+  tooling;
+  constructor(opts) {
+    this.opts = opts;
+    this.name = `Mirror ${opts.project}`;
+    this.fs = opts.fs ?? new NodeFs5;
+    this.ps = opts.ps ?? new NodePs5;
+    this.glob = opts.glob ?? new NodeGlob2;
+    this.tooling = new MirrorTooling({
+      project: opts.project,
+      fs: this.fs,
+      ps: this.ps
+    });
+  }
+  async run(cut) {
+    try {
+      await this.push(cut, await this.prepare(cut));
+    } finally {
+      await this.fs.rm(this.scratch, { recursive: true, force: true });
+    }
+  }
+  get scratch() {
+    return this.opts.scratch ?? join(tmpdir(), `mirror-${this.opts.project}-${this.ps.pid}`);
+  }
+  async prepare(cut, opts = {}) {
+    const { project, remote } = this.opts;
+    const branch = this.opts.branch ?? "main";
+    const mirror = `${this.scratch}/${project}`;
+    await this.fs.rm(this.scratch, { recursive: true, force: true });
+    await this.fs.mkdir(this.scratch);
+    await this.git(this.scratch, "clone", remote, mirror);
+    await this.checkout(mirror, branch);
+    await guard(this.ps, mirror, project, this.opts.adopt);
+    for (const entry of await this.fs.readdir(mirror)) {
+      if (entry !== ".git") {
+        await this.fs.rm(`${mirror}/${entry}`, { recursive: true });
+      }
+    }
+    const root = await this.build(cut, mirror);
+    await opts.before?.(mirror);
+    await this.git(mirror, "add", "--all");
+    const status = await this.git(mirror, "status", "--porcelain");
+    if (status.trim() === "") {
+      return { dir: mirror, from: `${root}/${project}`, changed: false };
+    }
+    const from = (await this.git(cut.root, "rev-parse", "HEAD")).trim();
+    await this.git(mirror, "commit", "--message", `Mirror ${project} at ${cut.tag}`, "--message", `${TRAILER}: ${from}`);
+    return { dir: mirror, from: `${root}/${project}`, changed: true };
+  }
+  async push(cut, prepared) {
+    const { project, remote } = this.opts;
+    if (prepared.changed) {
+      await this.git(prepared.dir, "push", "origin", this.opts.branch ?? "main");
+    } else {
+      cut.log.info(`${project} mirror is already current`);
+    }
+    if (this.opts.tag && !await this.tagged(prepared.dir, cut.tag)) {
+      await this.git(prepared.dir, "tag", cut.tag);
+      await this.git(prepared.dir, "push", "origin", cut.tag);
+    }
+    if (prepared.changed) {
+      cut.log.info(`${project} mirrored to ${remote} at ${cut.tag}`);
+    }
+  }
+  async dryRun(cut) {
+    await (await this.rehearsal(cut)).run(cut);
+    cut.log.info(`${this.opts.project} ${color.yellow("would push to")} ${this.opts.remote}`);
+  }
+  async rehearsal(cut) {
+    if (cut.dryRun === undefined) {
+      throw new Error("a mirror's dry run needs the dry run's directory");
+    }
+    const { dir } = cut.dryRun;
+    const remotes = `${dir}/remotes`;
+    const local = `${remotes}/${this.opts.project.replaceAll("/", "-")}.git`;
+    await this.fs.rm(local, { recursive: true, force: true });
+    await this.fs.mkdir(remotes);
+    await this.git(remotes, "clone", "--bare", "--quiet", this.opts.remote, local);
+    return new MirrorStep({
+      ...this.opts,
+      remote: local,
+      scratch: `${dir}/mirror-scratch`
+    });
+  }
+  async build(cut, mirror) {
+    const { project } = this.opts;
+    const source = this.opts.source ?? "core";
+    const workspace = this.opts.workspace ?? await ManifestWorkspace.at(cut.root, { fs: this.fs, ps: this.ps });
+    const root = workspace.root;
+    const excludes = this.opts.config?.exclude ?? [];
+    const keeps = this.opts.config?.keep ?? [];
+    const packages = await workspace.packages();
+    const own = packages.filter((pkg) => pkg.dir === `${root}/${project}` || pkg.dir.startsWith(`${root}/${project}/`));
+    const core = packages.find((pkg) => pkg.name === source);
+    if (own.length === 0) {
+      throw new Error(`${project} holds no workspace packages to mirror`);
+    }
+    if (core === undefined) {
+      throw new Error(`the workspace has no ${source} package to mirror`);
+    }
+    const published = await this.checkDependencies(own, core.name, packages);
+    const copied = await this.copy(`${root}/${project}`, mirror, (rel) => this.excluded(AGENT_FILES, rel) && !this.excluded(keeps, rel) || this.excluded(excludes, `${project}/${rel}`));
+    await this.publish(mirror, `${root}/${project}`, own, published);
+    await this.replace(mirror);
+    await this.rewrite(mirror);
+    const catalog = await catalogAt(this.fs, root);
+    const used = await this.reached(copied, core);
+    const coreOut = `${mirror}/${SOURCE_DIR}/${core.name}`;
+    for (const file of used.files) {
+      const rel = relative3(core.dir, file);
+      if (this.excluded(excludes, relative3(root, file))) {
+        throw new Error(`${project} reaches ${relative3(root, file)}, which the exclude globs leave out of the mirror`);
+      }
+      await this.copyFile(file, `${coreOut}/${rel}`);
+    }
+    for (const extra of ["tsconfig.json", "LICENSE"]) {
+      if (await this.fs.exists(`${core.dir}/${extra}`)) {
+        await this.copyFile(`${core.dir}/${extra}`, `${coreOut}/${extra}`);
+      }
+    }
+    await this.write(`${coreOut}/package.json`, await sourceManifest(this.fs, core, {
+      keys: used.keys,
+      files: used.files,
+      catalog,
+      version: cut.version
+    }));
+    await this.tooling.tsconfigs(mirror, await this.files(mirror));
+    await this.rootFiles(root, mirror, own, project, cut.version, catalog);
+    return root;
+  }
+  async checkDependencies(own, source, all) {
+    const names = new Set(own.map((pkg) => pkg.name));
+    const published = new Map;
+    for (const pkg of own) {
+      const manifest = await manifestAt(this.fs, pkg.dir);
+      for (const field of FIELDS) {
+        for (const [name, range] of Object.entries(manifest[field] ?? {})) {
+          if (NEVER2.includes(name)) {
+            throw new Error(`${pkg.name} depends on ${name}, which is never copied out of the repository`);
+          }
+          if (range.startsWith("workspace:") && name !== source && !names.has(name)) {
+            const other = all.find((one) => one.name === name);
+            if (other === undefined || other.private) {
+              throw new Error(`${pkg.name} depends on ${name}, which the mirror would not hold`);
+            }
+            published.set(name, other.dir);
+          }
+        }
+      }
+    }
+    return published;
+  }
+  async replace(mirror) {
+    for (const [to, from] of Object.entries(this.opts.config?.replace ?? {})) {
+      if (!await this.fs.exists(`${mirror}/${from}`)) {
+        throw new Error(`${this.opts.project} replaces ${to} with ${from}, which the mirror does not hold`);
+      }
+      await this.copyFile(`${mirror}/${from}`, `${mirror}/${to}`);
+      await this.fs.rm(`${mirror}/${from}`);
+    }
+  }
+  async rewrite(mirror) {
+    for (const [file, rules] of Object.entries(this.opts.config?.rewrite ?? {})) {
+      if (!await this.fs.exists(`${mirror}/${file}`)) {
+        throw new Error(`${this.opts.project} rewrites ${file}, which the mirror does not hold`);
+      }
+      let text = await this.fs.read(`${mirror}/${file}`);
+      for (const [pattern, to] of rules) {
+        const next = text.replace(pattern, to);
+        if (next === text) {
+          throw new Error(`${this.opts.project} rewrites ${file} with ${pattern}, which matches nothing`);
+        }
+        text = next;
+      }
+      await this.fs.write(`${mirror}/${file}`, text);
+    }
+  }
+  async publish(mirror, projectDir, own, published) {
+    if (published.size === 0) {
+      return;
+    }
+    const versions = new Map;
+    for (const [name, dir] of published) {
+      const manifest = await manifestAt(this.fs, dir);
+      versions.set(name, manifest.version ?? "0.0.0");
+    }
+    for (const pkg of own) {
+      const path = join(mirror, relative3(projectDir, pkg.dir), "package.json");
+      const manifest = JSON.parse(await this.fs.read(path));
+      for (const field of FIELDS) {
+        const deps = manifest[field];
+        for (const name of Object.keys(deps ?? {})) {
+          const version = versions.get(name);
+          if (version !== undefined && deps?.[name]?.startsWith("workspace:")) {
+            deps[name] = `^${version}`;
+          }
+        }
+      }
+      await this.write(path, manifest);
+    }
+  }
+  async reached(copied, core) {
+    const manifest = await manifestAt(this.fs, core.dir);
+    const exported = entries(manifest.exports ?? {});
+    const wanted = new Set;
+    for (const path of copied) {
+      if (!/\.tsx?$/.test(path)) {
+        continue;
+      }
+      for (const specifier of await specifiers(path, this.fs)) {
+        if (isPackage(specifier, core.name)) {
+          wanted.add(keyOf(core, exported, specifier));
+        }
+      }
+    }
+    return reach(this.fs, core, [...wanted]);
+  }
+  async rootFiles(root, mirror, own, project, version, catalog) {
+    const rootManifest = await manifestAt(this.fs, root);
+    const devDependencies = Object.fromEntries(Object.entries(rootManifest.devDependencies ?? {}).filter(([name]) => !NEVER2.includes(name)));
+    const manifests = [{ devDependencies }];
+    for (const pkg of own) {
+      manifests.push(await manifestAt(this.fs, join(mirror, relative3(`${root}/${project}`, pkg.dir))));
+    }
+    const used = {};
+    for (const manifest of manifests) {
+      for (const field of FIELDS) {
+        for (const [name, range] of Object.entries(manifest[field] ?? {})) {
+          if (range.startsWith("catalog:")) {
+            const resolved = catalog[name];
+            if (resolved === undefined) {
+              throw new Error(`${name} is ${range}, which the catalog lacks`);
+            }
+            used[name] = resolved;
+          }
+        }
+      }
+    }
+    const dirs = own.map((pkg) => relative3(`${root}/${project}`, pkg.dir));
+    const workspaces = {
+      packages: [
+        ...dirs.filter((one) => one !== "").toSorted(),
+        `${SOURCE_DIR}/${this.opts.source ?? "core"}`
+      ],
+      catalog: used
+    };
+    const scripts = this.opts.config?.scripts;
+    const top = dirs.includes("") ? JSON.parse(await this.fs.read(`${mirror}/package.json`)) : undefined;
+    await this.write(`${mirror}/package.json`, top === undefined ? {
+      name: project,
+      version,
+      private: true,
+      type: "module",
+      workspaces,
+      devDependencies,
+      ...scripts === undefined ? {} : { scripts }
+    } : {
+      ...top,
+      workspaces,
+      devDependencies: { ...devDependencies, ...top.devDependencies },
+      ...scripts === undefined ? {} : { scripts: { ...top.scripts, ...scripts } }
+    });
+    await this.copyFile(`${root}/tsconfig.base.json`, `${mirror}/tsconfig.base.json`);
+    await this.tooling.bunfig(root, mirror);
+    await this.tooling.lint(root, mirror, `${SOURCE_DIR}/${this.opts.source ?? "core"}`);
+    await this.tooling.gitignore(root, mirror);
+  }
+  async files(dir) {
+    const found = [];
+    for (const entry of await this.fs.readdir(dir)) {
+      if (SKIPPED.has(entry)) {
+        continue;
+      }
+      const path = `${dir}/${entry}`;
+      if ((await this.fs.stat(path)).isDirectory()) {
+        found.push(...await this.files(path));
+      } else {
+        found.push(path);
+      }
+    }
+    return found.toSorted();
+  }
+  async copy(from, to, skip) {
+    const copied = [];
+    for (const path of await this.files(from)) {
+      const rel = relative3(from, path);
+      if (skip(rel)) {
+        continue;
+      }
+      await this.copyFile(path, `${to}/${rel}`);
+      copied.push(`${to}/${rel}`);
+    }
+    return copied;
+  }
+  async copyFile(from, to) {
+    await this.fs.mkdir(dirname6(to));
+    await this.fs.writeBytes(to, await this.fs.readBytes(from));
+    const { mode } = await this.fs.stat(from);
+    if ((mode & 73) !== 0) {
+      await this.fs.chmod(to, mode & 511);
+    }
+  }
+  async write(path, value) {
+    await this.fs.mkdir(dirname6(path));
+    await this.fs.write(path, `${JSON.stringify(value, null, "\t")}
+`);
+  }
+  excluded(globs, rel) {
+    return globs.some((glob) => this.glob.matches(glob, rel));
+  }
+  async tagged(mirror, tag) {
+    const found = await this.git(mirror, "ls-remote", "--tags", "origin", `refs/tags/${tag}`);
+    return found.trim() !== "";
+  }
+  async checkout(mirror, branch) {
+    const has = await this.ps.spawnCapture(["git", "rev-parse", "--verify", "--quiet", `origin/${branch}`], { cwd: mirror });
+    if (has.exitCode === 0) {
+      await this.git(mirror, "checkout", "-B", branch, `origin/${branch}`);
+    } else {
+      await this.git(mirror, "checkout", "-B", branch);
+    }
+  }
+  async git(cwd, ...args) {
+    const result = await this.ps.spawnCapture(["git", ...args], { cwd });
+    if (result.exitCode !== 0) {
+      throw new Error(`git ${args.join(" ")} failed in ${cwd}: ${result.stderr.trim()}`);
+    }
+    return result.stdout;
+  }
+}
+
+// ship/mirror/mirror-build.ts
+class MirrorBuild {
+  opts;
+  packages = [];
+  stage = "build";
+  name;
+  fs;
+  ps;
+  mirror;
+  bundle;
+  built;
+  constructor(opts) {
+    this.opts = opts;
+    this.name = `Build ${opts.project} in its mirror`;
+    this.fs = opts.fs ?? new NodeFs6;
+    this.ps = opts.ps ?? new NodePs6;
+    this.mirror = new MirrorStep(opts);
+    this.bundle = opts.bundle ?? new VendorBundle({ fs: this.fs, ps: this.ps });
+  }
+  steps() {
+    const build = (cut) => this.build(cut);
+    const push = (cut) => this.push(cut);
+    return [
+      {
+        name: this.name,
+        deadline: Duration2.mins(15),
+        stage: "build",
+        run: build,
+        dryRun: build
+      },
+      {
+        name: `Mirror ${this.opts.project}`,
+        deadline: Duration2.mins(5),
+        stage: "tag",
+        run: push,
+        dryRun: async (cut) => {
+          await push(cut);
+          cut.log.info(`${this.opts.project} ${color2.yellow("would push to")} ${this.opts.remote}`);
+        }
+      }
+    ];
+  }
+  async publish(cut) {
+    await this.build(cut);
+    await this.push(cut);
+  }
+  async clean() {
+    if (this.built !== undefined) {
+      await this.fs.rm(this.built.step.scratch, {
+        recursive: true,
+        force: true
+      });
+      this.built = undefined;
+    }
+  }
+  async build(cut) {
+    await this.clean();
+    const step = cut.dryRun === undefined ? this.mirror : await this.mirror.rehearsal(cut);
+    const prepared = await step.prepare(cut, {
+      before: async (mirror) => {
+        if (this.opts.publish !== undefined) {
+          await new PublishWorkflow({
+            command: this.opts.publish,
+            fs: this.fs
+          }).write(mirror);
+        }
+        await this.spawn(["bun", "install"], mirror);
+      }
+    });
+    this.built = { step, prepared };
+    this.opts.via?.use(new CliGit(prepared.dir, { ps: this.ps }));
+    const going = cut.packages.filter((pkg) => !pkg.private && (pkg.dir === prepared.from || pkg.dir.startsWith(`${prepared.from}/`)));
+    for (const pkg of going) {
+      const dir = join2(prepared.dir, relative4(prepared.from, pkg.dir));
+      cut.stage(pkg.name, await this.bundle.build(dir));
+    }
+    cut.log.info(`${going.length} packages ${color2.green("built")} in the ${this.opts.project} mirror`);
+  }
+  async push(cut) {
+    if (this.built === undefined) {
+      throw new Error(`the ${this.opts.project} mirror was never built, so there is nothing to push`);
+    }
+    await this.built.step.push(cut, this.built.prepared);
+  }
+  async spawn(argv, cwd) {
+    const { exitCode, stdout, stderr } = await this.ps.spawnCapture(argv, {
+      cwd
+    });
+    if (exitCode !== 0) {
+      const said = `${stdout}
+${stderr}`.trim().split(`
+`).slice(-20);
+      throw new Error(`${argv.join(" ")} failed in the ${this.opts.project} mirror:
+${said.join(`
+`)}`);
+    }
+  }
+}
+// ship/order.ts
+function order(packages) {
+  let remaining = [...packages].sort((left, right) => left.name.localeCompare(right.name));
+  const siblings = new Set(remaining.map((pkg) => pkg.name));
+  const published = new Set;
+  const ordered = [];
+  while (remaining.length > 0) {
+    const ready = remaining.filter((pkg) => pkg.dependencies.every((dep) => !siblings.has(dep) || published.has(dep)));
+    if (ready.length === 0) {
+      throw new Error(`dependency cycle: ${remaining.map((pkg) => pkg.name).join(", ")} each wait on another, so no order releases them`);
+    }
+    for (const pkg of ready) {
+      ordered.push(pkg);
+      published.add(pkg.name);
+    }
+    remaining = remaining.filter((pkg) => !published.has(pkg.name));
+  }
+  return ordered;
+}
+// ship/registry/github-actions.ts
+import { basename } from "node:path";
+import { NodePs as NodePs8 } from "../system/index.js";
+import { Duration as Duration3, sleep } from "../time/index.js";
+
+// ship/github/cli-workflows.ts
+import { NodePs as NodePs7 } from "../system/index.js";
+
+// ship/github/login.ts
+async function ghLogin(ps) {
+  if ((await ps.spawnCapture(["gh", "auth", "status"])).exitCode === 0) {
+    return;
+  }
+  if (ps.env("CI") !== undefined) {
+    throw new Error("not logged in to GitHub: set GH_TOKEN");
+  }
+  const { exitCode } = await ps.spawn(["gh", "auth", "login"]);
+  if (exitCode !== 0) {
+    throw new Error("gh auth login failed");
+  }
+}
+
+// ship/github/cli-workflows.ts
+class CliWorkflows {
+  ps;
+  named;
+  constructor(opts = {}) {
+    this.ps = opts.ps ?? new NodePs7;
+    this.named = opts.repo;
+  }
+  repo() {
+    if (this.named !== undefined) {
+      return Promise.resolve(this.named);
+    }
+    return this.gh(["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"], false);
+  }
+  async registered(file) {
+    await ghLogin(this.ps);
+    const { exitCode, stdout } = await this.ps.spawnCapture([
+      "gh",
+      "api",
+      `repos/${await this.repo()}/actions/workflows/${file}`,
+      "--jq",
+      ".state"
+    ]);
+    return exitCode === 0 && stdout.trim() === "active";
+  }
+  async dispatch(file, branch, inputs) {
+    await this.gh([
+      "workflow",
+      "run",
+      file,
+      "--ref",
+      branch,
+      ...Object.entries(inputs).flatMap(([key, value]) => [
+        "--field",
+        `${key}=${value}`
+      ])
+    ]);
+  }
+  async runs(file, sha) {
+    const out = await this.gh([
+      "run",
+      "list",
+      "--workflow",
+      file,
+      "--commit",
+      sha,
+      "--json",
+      "databaseId,url,status,conclusion,attempt",
+      "--limit",
+      "10"
+    ]);
+    const found = JSON.parse(out || "[]");
+    return found.map((run) => ({
+      id: String(run.databaseId),
+      url: run.url,
+      status: run.status,
+      ...run.conclusion === "" ? {} : { conclusion: run.conclusion },
+      attempt: run.attempt
+    }));
+  }
+  async rerun(id, failedOnly) {
+    await this.gh(["run", "rerun", id, ...failedOnly ? ["--failed"] : []]);
+  }
+  async failedLog(id) {
+    return this.gh(["run", "view", id, "--log-failed"], false);
+  }
+  async gh(args, login = true) {
+    if (login) {
+      await ghLogin(this.ps);
+    }
+    const { exitCode, stdout, stderr } = await this.ps.spawnCapture([
+      "gh",
+      ...args,
+      ...this.named === undefined ? [] : ["--repo", this.named]
+    ]);
+    if (exitCode !== 0) {
+      throw new Error(`gh ${args.slice(0, 2).join(" ")}: ${stderr.trim() || stdout.trim()}`);
+    }
+    return stdout.trim();
+  }
+}
+
+// ship/registry/github-actions.ts
+var LOG_LINES = 20;
+var REGISTER_WITHIN = Duration3.mins(2);
+var REGISTER_EVERY = Duration3.secs(5);
+function githubActions(opts = {}) {
+  return new GithubActions(opts);
+}
+
+class GithubActions {
+  file = basename(PUBLISH_WORKFLOW_PATH);
+  git;
+  workflows;
+  rerunFrom;
+  trustCommand;
+  pause;
+  constructor(opts = {}) {
+    const ps = opts.ps ?? new NodePs8;
+    this.git = opts.git ?? new CliGit(ps.cwd(), { ps });
+    this.workflows = opts.workflows ?? new CliWorkflows({ ps, repo: opts.repo });
+    this.trustCommand = opts.trustCommand ?? "bunx @webappwiz/cli ship trust";
+    this.pause = opts.pause ?? sleep;
+  }
+  use(git) {
+    this.git = git;
+  }
+  repo() {
+    return this.workflows.repo();
+  }
+  async start() {
+    const branch = await this.git.branch();
+    await this.git.push(branch);
+    await this.untilRegistered();
+    const sha = await this.git.head();
+    const [latest] = await this.workflows.runs(this.file, sha);
+    if (latest === undefined) {
+      await this.workflows.dispatch(this.file, branch, { ref: sha });
+      return;
+    }
+    if (latest.status === "completed" && latest.conclusion !== "success") {
+      this.rerunFrom = { id: latest.id, attempt: latest.attempt };
+      await this.workflows.rerun(latest.id, latest.conclusion === "failure");
+    }
+  }
+  async untilRegistered() {
+    let waited = Duration3.zero();
+    while (!await this.workflows.registered(this.file)) {
+      if (waited.ms >= REGISTER_WITHIN.ms) {
+        throw new Error(`GitHub has not registered ${this.file} ${REGISTER_WITHIN.ms / 1000}s after the push: check that it is on the repository's default branch, then ship again`);
+      }
+      await this.pause(REGISTER_EVERY);
+      waited = waited.add(REGISTER_EVERY);
+    }
+  }
+  async watch(name, live) {
+    const [run] = await this.workflows.runs(this.file, await this.git.head());
+    if (run === undefined) {
+      return live ? { passed: true } : { passed: false, status: "waiting" };
+    }
+    const { url } = run;
+    if (run.status !== "completed") {
+      return { passed: false, status: run.status, url };
+    }
+    if (this.rerunFrom?.id === run.id && run.attempt <= this.rerunFrom.attempt) {
+      return { passed: false, status: "queued", url };
+    }
+    if (run.conclusion === "success") {
+      return { passed: true, url };
+    }
+    throw new Error(await this.failure(name, run.id, url, run.conclusion));
+  }
+  async failure(name, id, url, conclusion) {
+    const log = await this.workflows.failedLog(id);
+    const tail = log.split(`
+`).slice(-LOG_LINES).join(`
+`);
+    const refused = /OIDC token exchange/i.test(log) ? `
+${await this.setup(name)}` : "";
+    return `the publish run ${conclusion ?? "ended"}: ${url}
+${tail}${refused}`;
+  }
+  async setup(name) {
+    const repo = await this.workflows.repo();
+    return [
+      `npm refused the run: ${name} has no trusted publisher entry for it. Run \`${this.trustCommand}\` to set one up for every package, or for this one alone:`,
+      `  npm trust github ${name} --repo ${repo} --file ${this.file} --allow-publish`,
+      "The package must already exist. A new entry lapses after about two days unless a publish uses it. Then ship again to rerun the failed run."
+    ].join(`
+`);
+  }
+}
+// ship/release.ts
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join3 } from "node:path";
+import { ConsoleLogger as ConsoleLogger3, color as color5 } from "../log/index.js";
+import { NodeFs as NodeFs8, NodePs as NodePs9 } from "../system/index.js";
+import { Duration as Duration7 } from "../time/index.js";
+
+// ship/artifact/artifact.ts
+var STAGES = [
+  "stamp",
+  "build",
+  "publish",
+  "approve",
+  "tag",
+  "notes"
+];
+
+// ship/dry-run.ts
+import { rm } from "node:fs/promises";
+import { color as color3 } from "../log/index.js";
+import { Duration as Duration4 } from "../time/index.js";
+var SCRIPT = /\.[cm]?js$/;
+var TESTING = /(^|\/)testing$/;
+async function rehearse(opts) {
+  const { preflight, before, versionStep, going, cut, runner, git } = opts;
+  const install = {
+    id: "dry-run:install",
+    step: installStep({ packages: opts.packages, fs: opts.fs, ps: opts.ps })
+  };
+  const after = going.findIndex(({ step }) => STAGES.indexOf(step.stage === "preflight" ? "publish" : step.stage ?? "publish") > STAGES.indexOf("publish"));
+  const declared = [preflight, ...before, versionStep];
+  const steps = [
+    ...declared,
+    ...after === -1 ? going : going.slice(0, after),
+    install,
+    ...after === -1 ? [] : going.slice(after)
+  ];
+  await runner.declare(steps);
+  let stamped = false;
+  try {
+    for (const declaration of steps) {
+      stamped ||= declaration === versionStep;
+      await runner.run(rehearsed(declaration), cut);
+    }
+  } finally {
+    for (const artifact of opts.artifacts) {
+      await artifact.clean?.(cut);
+    }
+    if (stamped) {
+      await git.discard();
+    }
+    if (opts.owned && cut.dryRun !== undefined) {
+      await rm(cut.dryRun.dir, { recursive: true, force: true });
+    }
+  }
+  cut.log.info(color3.green(`rehearsed ${cut.version}: nothing went out`));
+}
+function installStep(opts) {
+  return {
+    name: "Install the packs",
+    deadline: Duration4.mins(5),
+    stage: "approve",
+    run: (cut) => install(cut, opts),
+    dryRun: (cut) => install(cut, opts)
+  };
+}
+async function install(cut, opts) {
+  const { fs, ps } = opts;
+  if (cut.dryRun === undefined || opts.packages.length === 0) {
+    return;
+  }
+  const packs = `${cut.dryRun.dir}/packs`;
+  const tarballs = (await fs.readdir(packs)).filter((file) => file.endsWith(".tgz")).map((file) => `${packs}/${file}`);
+  if (tarballs.length === 0) {
+    return;
+  }
+  const consumer = `${cut.dryRun.dir}/consumer`;
+  await fs.rm(consumer, { recursive: true, force: true });
+  await fs.mkdir(consumer);
+  await fs.write(`${consumer}/package.json`, `${JSON.stringify({ name: "dry-run", private: true, type: "module" })}
+`);
+  await spawn(ps, [
+    "npm",
+    "install",
+    "--no-audit",
+    "--no-fund",
+    "--no-package-lock",
+    ...tarballs
+  ], consumer);
+  const specifiers = [];
+  let runtime = "node";
+  for (const name of opts.packages) {
+    const dir = `${consumer}/node_modules/${name}`;
+    const manifest = JSON.parse(await fs.read(`${dir}/package.json`));
+    specifiers.push(...importable(name, manifest));
+    if (runsOnBun(manifest)) {
+      runtime = "bun";
+    }
+    for (const bin of Object.values(bins(manifest))) {
+      if (!await fs.exists(`${dir}/${bin}`)) {
+        throw new Error(`${name} names bin ${bin}, which it does not hold`);
+      }
+    }
+  }
+  await fs.write(`${consumer}/imports.mjs`, specifiers.map((specifier) => `await import(${JSON.stringify(specifier)});`).join(`
+`));
+  await spawn(ps, [runtime, "imports.mjs"], consumer);
+  cut.log.info(`${opts.packages.join(" ")} ${color3.green("installed")} from the packs, ${specifiers.length} imports resolving`);
+}
+function importable(name, manifest) {
+  if (manifest.exports === undefined) {
+    return manifest.main !== undefined && SCRIPT.test(manifest.main) ? [name] : [];
+  }
+  if (typeof manifest.exports === "string") {
+    return SCRIPT.test(manifest.exports) ? [name] : [];
+  }
+  return Object.entries(manifest.exports).filter(([key, target]) => key.startsWith(".") && !TESTING.test(key) && script(target)).map(([key]) => key === "." ? name : `${name}/${key.slice(2)}`);
+}
+function script(target) {
+  if (typeof target === "string") {
+    return SCRIPT.test(target);
+  }
+  const chosen = target.import ?? target.default;
+  return chosen !== undefined && script(chosen);
+}
+function runsOnBun(manifest) {
+  const engines = manifest.engines;
+  return typeof engines === "object" && engines !== null && "bun" in engines;
+}
+function bins(manifest) {
+  const { bin, name } = manifest;
+  if (bin === undefined) {
+    return {};
+  }
+  return typeof bin === "string" ? { [name ?? "bin"]: bin } : bin;
+}
+async function spawn(ps, argv, cwd) {
+  const { exitCode, stdout, stderr } = await ps.spawnCapture(argv, { cwd });
+  if (exitCode !== 0) {
+    const said = `${stdout}
+${stderr}`.trim().split(`
+`).slice(-20).join(`
+`);
+    throw new Error(`${argv.slice(0, 2).join(" ")} failed in ${cwd}:
+${said}`);
+  }
+}
+var LOCAL2 = ["preflight", "stamp", "build"];
+function rehearsed(declaration) {
+  const { step } = declaration;
+  const name = step.name;
+  if (step.dryRun !== undefined) {
+    const dryRun = step.dryRun.bind(step);
+    return {
+      ...declaration,
+      step: { name, deadline: step.deadline, stage: step.stage, run: dryRun }
+    };
+  }
+  if (LOCAL2.includes(step.stage ?? "publish")) {
+    return declaration;
+  }
+  return {
+    ...declaration,
+    step: {
+      name,
+      deadline: step.deadline,
+      stage: step.stage,
+      run: async (cut) => {
+        cut.log.info(color3.yellow(`would run ${name}, which has no dry run`));
+      }
+    }
+  };
+}
+
+// ship/release-file.ts
+import { NodeFs as NodeFs7 } from "../system/index.js";
+
+class ReleaseFile {
+  path;
+  fs;
+  constructor(root, opts = {}) {
+    this.path = `${root}/RELEASE`;
+    this.fs = opts.fs ?? new NodeFs7;
+  }
+  async read() {
+    if (!await this.fs.exists(this.path)) {
+      return null;
+    }
+    const state = parse(await this.fs.read(this.path));
+    if (state === null) {
+      throw new Error(`${this.path} does not hold release state: finish the release it was tracking or delete it`);
+    }
+    return state;
+  }
+  async write(state) {
+    await this.fs.write(this.path, `${JSON.stringify(state, null, "\t")}
+`);
+  }
+  async clear() {
+    await this.fs.rm(this.path, { force: true });
+  }
+}
+function parse(contents) {
+  try {
+    const state = JSON.parse(contents);
+    if (typeof state.version !== "string" || !Array.isArray(state.done) || !state.done.every((key) => typeof key === "string")) {
+      return null;
+    }
+    return { version: state.version, done: state.done };
+  } catch {
+    return null;
+  }
+}
+
+// ship/step-events.ts
+import { SystemWallClock } from "../time/index.js";
+var EVENTS_SCHEMA = 1;
+
+class StepEvents {
+  path;
+  fs;
+  clock;
+  progress;
+  constructor(path, fs, clock = new SystemWallClock, progress) {
+    this.path = path;
+    this.fs = fs;
+    this.clock = clock;
+    this.progress = progress;
+  }
+  async declared({
+    id,
+    step,
+    packages,
+    artifact
+  }) {
+    await this.write({
+      type: "declared",
+      id,
+      name: step.name,
+      stage: step.stage ?? "publish",
+      packages: [...packages ?? []],
+      ...artifact === undefined ? {} : { artifact },
+      deadlineMs: step.deadline.ms,
+      at: this.at()
+    });
+  }
+  async started({ id, step }) {
+    this.report(id, "start");
+    await this.write({ type: "started", id, name: step.name, at: this.at() });
+  }
+  async staged({ id, step }, info) {
+    await this.write({
+      type: "staged",
+      id,
+      name: step.name,
+      ...info,
+      at: this.at()
+    });
+  }
+  async check(declaration, { passed, status, url }) {
+    await this.write({
+      type: "check",
+      id: declaration.id,
+      name: declaration.step.name,
+      passed,
+      ...status === undefined ? {} : { status },
+      ...url === undefined ? {} : { url },
+      at: this.at()
+    });
+  }
+  async done({ id, step }) {
+    this.report(id, "done");
+    await this.write({ type: "done", id, name: step.name, at: this.at() });
+  }
+  async skipped({ id, step }) {
+    this.report(id, "skipped");
+    await this.write({ type: "skipped", id, name: step.name, at: this.at() });
+  }
+  async failed({ id, step }, error) {
+    this.report(id, "failed");
+    await this.write({
+      type: "failed",
+      id,
+      name: step.name,
+      error: error instanceof Error ? error.message : String(error),
+      at: this.at()
+    });
+  }
+  report(id, state) {
+    this.progress?.line(JSON.stringify({ event: "step", id, state, at: this.at() }));
+  }
+  async write(event) {
+    if (this.path !== undefined && this.path !== "") {
+      await this.fs.append(this.path, `${JSON.stringify({ schema: EVENTS_SCHEMA, ...event })}
+`);
+    }
+  }
+  at() {
+    return new Date(this.clock.now()).toISOString();
+  }
+}
+
+// ship/step-runner.ts
+import { Duration as Duration5, SystemTimer } from "../time/index.js";
+var CHECK_INTERVAL = Duration5.secs(10);
+var CHECK_BACKOFF_MAX = Duration5.mins(2);
+
+class StepRunner {
+  events;
+  timer;
+  constructor(events, timer = new SystemTimer) {
+    this.events = events;
+    this.timer = timer;
+  }
+  async declare(steps) {
+    for (const step of steps) {
+      await this.events.declared(step);
+    }
+  }
+  async run(declaration, cut, opts = {}) {
+    if (opts.done === true) {
+      await this.events.skipped(declaration);
+      return;
+    }
+    await this.events.started(declaration);
+    try {
+      await declaration.step.run(cut, {
+        staged: (info) => this.events.staged(declaration, info)
+      });
+      let waited = Duration5.zero();
+      let interval = CHECK_INTERVAL;
+      while (declaration.step.check !== undefined) {
+        const found = await declaration.step.check(cut, waited);
+        const report = typeof found === "boolean" ? { passed: found } : found;
+        await this.events.check(declaration, report);
+        if (report.passed) {
+          break;
+        }
+        const every = declaration.step.checkEvery ?? interval;
+        await this.wait(every);
+        waited = waited.add(every);
+        interval = Duration5.min(interval.multiply(2), CHECK_BACKOFF_MAX);
+      }
+      await this.events.done(declaration);
+    } catch (error) {
+      await this.events.failed(declaration, error);
+      throw error;
+    }
+  }
+  async wait(interval) {
+    await new Promise((resolve) => {
+      const waiting = this.timer.setTimeout(() => {
+        waiting.dispose();
+        resolve();
+      }, interval);
+    });
+  }
+}
+
+// ship/trust.ts
+import { ConsoleLogger as ConsoleLogger2, color as color4 } from "../log/index.js";
+import { Duration as Duration6, sleep as sleep2 } from "../time/index.js";
+async function trust(artifacts, opts = {}) {
+  const log = opts.log ?? new ConsoleLogger2;
+  const pause = opts.pause ?? Duration6.secs(2);
+  const trusting = artifacts.flatMap((artifact) => {
+    const trust = artifact.trust?.bind(artifact);
+    return trust === undefined ? [] : [{ artifact, trust }];
+  });
+  if (trusting.length === 0) {
+    throw new Error("nothing in this release publishes from CI: give its registry `via: githubActions()`");
+  }
+  const failed = [];
+  for (const [index, { artifact, trust }] of trusting.entries()) {
+    if (index > 0) {
+      await sleep2(pause);
+    }
+    const name = artifact.name ?? statusName(artifact);
+    try {
+      await trust(log);
+      log.info(`${name} ${color4.green("trusts the publish workflow")}`);
+    } catch (error) {
+      failed.push(error.message);
+    }
+  }
+  if (failed.length > 0) {
+    throw new Error(failed.join(`
+`));
+  }
+}
+
+// ship/version.ts
+var SEMVER = /^(\d+)\.(\d+)\.(\d+)$/;
+function newest(versions) {
+  let best;
+  for (const version of versions) {
+    const match = SEMVER.exec(version);
+    if (match === null) {
+      continue;
+    }
+    const parts = match.slice(1).map(Number);
+    if (best === undefined || compare(parts, best.parts) > 0) {
+      best = { version, parts };
+    }
+  }
+  return best?.version;
+}
+function compare(left, right) {
+  for (const [index, part] of left.entries()) {
+    const diff = part - (right[index] ?? 0);
+    if (diff !== 0) {
+      return diff;
+    }
+  }
+  return 0;
+}
+function bump(version, type) {
+  const parts = SEMVER.exec(version);
+  if (parts === null) {
+    throw new Error(`invalid version: "${version}" (expected major.minor.patch)`);
+  }
+  const [major, minor, patch] = [
+    Number(parts[1]),
+    Number(parts[2]),
+    Number(parts[3])
+  ];
+  switch (type) {
+    case "major":
+      return `${major + 1}.0.0`;
+    case "minor":
+      return `${major}.${minor + 1}.0`;
+    case "patch":
+      return `${major}.${minor}.${patch + 1}`;
+  }
+}
+
+// ship/release.ts
+class Release {
+  artifacts;
+  steps;
+  constructor(artifacts, steps = []) {
+    this.artifacts = artifacts.toSorted((left, right) => STAGES.indexOf(left.stage ?? "publish") - STAGES.indexOf(right.stage ?? "publish"));
+    this.steps = steps;
+  }
+  get packages() {
+    return this.artifacts.flatMap((artifact) => [...artifact.packages]);
+  }
+  async status(opts = {}) {
+    const ps = opts.ps ?? new NodePs9;
+    const workspace = opts.workspace ?? await ManifestWorkspace.at(ps.cwd(), {
+      fs: opts.fs,
+      ps,
+      project: opts.project
+    });
+    const reading = this.artifacts.flatMap((artifact) => {
+      const deployed = artifact.deployed?.bind(artifact);
+      return deployed === undefined ? [] : [{ artifact, deployed }];
+    });
+    const [version, artifacts] = await Promise.all([
+      workspace.version(),
+      Promise.all(reading.map(async ({ artifact, deployed }) => ({
+        name: artifact.name ?? statusName(artifact),
+        packages: artifact.packages,
+        deployed: await deployed()
+      })))
+    ]);
+    return { version, artifacts };
+  }
+  async release(opts = {}) {
+    const ps = opts.ps ?? new NodePs9;
+    const log = opts.log ?? new ConsoleLogger3;
+    const fs = opts.fs ?? new NodeFs8;
+    const workspace = opts.workspace ?? await ManifestWorkspace.at(ps.cwd(), { fs, ps, project: opts.project });
+    const git = opts.git ?? new CliGit(workspace.root, { ps });
+    const packages = order(await workspace.packages());
+    const file = new ReleaseFile(workspace.root, { fs });
+    const found = await file.read();
+    const next = {
+      bump: opts.bump ?? "patch",
+      resuming: found !== null,
+      current: await workspace.version()
+    };
+    const version = found?.version ?? bump(next.current, next.bump);
+    const owned = opts.dryRun === true ? { dir: await mkdtemp(join3(tmpdir2(), "ship-dry-run-")) } : undefined;
+    const dryRun = owned ?? (typeof opts.dryRun === "object" ? opts.dryRun : undefined);
+    if (dryRun !== undefined) {
+      await fs.mkdir(`${dryRun.dir}/packs`);
+    }
+    const cut = new Cut(version, packages, {
+      log,
+      root: workspace.root,
+      dryRun
+    });
+    const runner = new StepRunner(new StepEvents(ps.env("WEBAPPWIZ_SHIP_EVENTS") ?? ps.env("SPLATES_SHIP_EVENTS"), fs, opts.wallClock, ps.env("WEBAPPWIZ_SHIP_PROGRESS") === "1" ? { line: (text) => log.info(text) } : undefined), opts.timer);
+    const declared = this.declare({
+      workspace,
+      git,
+      packages,
+      cut,
+      version
+    });
+    if (dryRun !== undefined) {
+      await rehearse({
+        ...declared,
+        artifacts: this.artifacts,
+        packages: this.packages,
+        cut,
+        runner,
+        git,
+        fs,
+        ps,
+        owned: owned !== undefined
+      });
+      return;
+    }
+    const { preflight, before, versionStep, going } = declared;
+    await runner.declare([preflight, ...before, versionStep, ...going]);
+    await runner.run(preflight, cut);
+    for (const step of before) {
+      await runner.run(step, cut);
+    }
+    if (!confirm(opts.prompt ?? prompt, log, this.packages, version, next, opts.yes)) {
+      log.info(color5.red("aborted"));
+      return;
+    }
+    const state = found ?? { version, done: [] };
+    await file.write(state);
+    try {
+      await runner.run(versionStep, cut);
+      for (const declaration of going) {
+        const done = declaration.step.stage !== "build" && state.done.includes(declaration.id);
+        await runner.run(declaration, cut, { done });
+        if (!state.done.includes(declaration.id)) {
+          state.done.push(declaration.id);
+        }
+        await file.write(state);
+      }
+    } finally {
+      for (const artifact of this.artifacts) {
+        await artifact.clean?.(cut);
+      }
+    }
+    await file.clear();
+    log.info(color5.green(`shipped ${version}`));
+  }
+  async trust(opts = {}) {
+    await trust(this.artifacts, opts);
+  }
+  async publish(opts = {}) {
+    const ps = opts.ps ?? new NodePs9;
+    const log = opts.log ?? new ConsoleLogger3;
+    const fs = opts.fs ?? new NodeFs8;
+    const workspace = opts.workspace ?? await ManifestWorkspace.at(ps.cwd(), { fs, ps, project: opts.project });
+    const packages = order(await workspace.packages());
+    declares(this.packages, packages);
+    const version = await workspace.version();
+    const cut = new Cut(version, packages, { log, root: workspace.root });
+    const going = sequence(this.artifacts.filter((artifact) => artifact.stage === "build" || artifact.stage === undefined || artifact.stage === "publish"), packages);
+    const publishing = going.map((artifact) => artifact.trusted?.() ?? artifact);
+    const steps = publishing.flatMap((artifact) => stepsFor(artifact, cut)).filter((step) => step.stage === "build" || step.stage === "publish").toSorted((left, right) => stageRank(left) - stageRank(right)).map((step, index) => ({
+      id: `step:${index}:${step.name}`,
+      step
+    }));
+    const runner = new StepRunner(new StepEvents(ps.env("WEBAPPWIZ_SHIP_EVENTS") ?? ps.env("SPLATES_SHIP_EVENTS"), fs, opts.wallClock), opts.timer);
+    await runner.declare(steps);
+    try {
+      for (const declaration of steps) {
+        await runner.run(declaration, cut);
+      }
+    } finally {
+      for (const artifact of publishing) {
+        await artifact.clean?.(cut);
+      }
+    }
+    log.info(color5.green(`published ${version}`));
+  }
+  declare(at) {
+    const { workspace, git, packages, cut, version } = at;
+    const preflight = {
+      id: "preflight",
+      step: {
+        name: "Preflight",
+        deadline: Duration7.secs(30),
+        stage: "preflight",
+        run: async () => {
+          const [branch, trunk] = [
+            await git.branch(),
+            await git.defaultBranch()
+          ];
+          if (branch !== trunk) {
+            if (cut.dryRun === undefined) {
+              throw new Error(`on "${branch}": releases go out from "${trunk}"`);
+            }
+            cut.log.info(color5.yellow(`on "${branch}": a release would refuse it, as releases go out from "${trunk}"`));
+          }
+          if (!await git.clean()) {
+            throw new Error("uncommitted changes: releases go out from a clean tree, so commit or discard them first");
+          }
+          declares(this.packages, packages);
+          for (const artifact of this.artifacts) {
+            await artifact.verify?.(cut);
+          }
+        }
+      }
+    };
+    const before = this.steps.filter((step) => step.stage === "preflight").map((step, index) => ({ id: `preflight:${index}:${step.name}`, step }));
+    const ordered = sequence(this.artifacts, packages);
+    const stamps = ordered.filter((artifact) => artifact.stage === "stamp");
+    const stamping = this.steps.filter((step) => step.stage === "stamp");
+    const versionStep = {
+      id: "version",
+      step: {
+        name: `Version ${version}`,
+        deadline: Duration7.mins(2),
+        stage: "stamp",
+        run: async () => {
+          await workspace.setVersion(version);
+          for (const artifact of stamps) {
+            await artifact.publish(cut);
+          }
+          for (const step of stamping) {
+            await step.run(cut);
+          }
+          if (cut.dryRun === undefined) {
+            await git.commitAll(`Release ${version}`);
+          }
+        }
+      }
+    };
+    const going = [
+      ...ordered.filter((artifact) => artifact.stage !== "stamp").flatMap((artifact) => stepsFor(artifact, cut).map((step) => ({ step, artifact }))),
+      ...this.steps.filter((step) => step.stage !== "preflight" && step.stage !== "stamp").map((step) => ({ step, artifact: undefined }))
+    ].toSorted((left, right) => stageRank(left.step) - stageRank(right.step)).map(({ step, artifact }, index) => ({
+      id: `step:${index}:${step.name}`,
+      step,
+      artifact: artifact && (artifact.name ?? statusName(artifact)),
+      packages: artifact?.packages
+    }));
+    return { preflight, before, versionStep, going };
+  }
+  async plan(opts = {}) {
+    const ps = opts.ps ?? new NodePs9;
+    const fs = opts.fs ?? new NodeFs8;
+    const workspace = opts.workspace ?? await ManifestWorkspace.at(ps.cwd(), { fs, ps, project: opts.project });
+    const git = opts.git ?? new CliGit(workspace.root, { ps });
+    const packages = order(await workspace.packages());
+    const found = await new ReleaseFile(workspace.root, { fs }).read();
+    const version = found?.version ?? bump(await workspace.version(), opts.bump ?? "patch");
+    const cut = new Cut(version, packages, {
+      log: opts.log ?? new ConsoleLogger3,
+      root: workspace.root
+    });
+    const { preflight, before, versionStep, going } = this.declare({
+      workspace,
+      git,
+      packages,
+      cut,
+      version
+    });
+    return {
+      schema: 1,
+      version,
+      resuming: found !== null,
+      steps: [preflight, ...before, versionStep, ...going].map(({ id, step, artifact, packages: covered }) => ({
+        id,
+        name: step.name,
+        stage: step.stage ?? "publish",
+        packages: [...covered ?? []],
+        ...artifact === undefined ? {} : { artifact },
+        deadlineMs: step.deadline.ms
+      }))
+    };
+  }
+}
+function sequence(artifacts, packages) {
+  const rank = new Map(packages.map((pkg, index) => [pkg.name, index]));
+  const at = (artifact) => {
+    const ranks = artifact.packages.map((name) => rank.get(name) ?? packages.length);
+    return ranks.length === 0 ? packages.length : Math.min(...ranks);
+  };
+  return artifacts.toSorted((left, right) => {
+    const stages = STAGES.indexOf(left.stage ?? "publish") - STAGES.indexOf(right.stage ?? "publish");
+    return stages !== 0 ? stages : at(left) - at(right);
+  });
+}
+function stepsFor(artifact, cut) {
+  if (artifact.steps !== undefined) {
+    return artifact.steps(cut).map((step) => ({
+      ...step,
+      stage: step.stage ?? artifact.stage
+    }));
+  }
+  return [
+    {
+      name: artifactName(artifact),
+      deadline: deadlineFor(artifact.stage),
+      stage: artifact.stage,
+      run: (at) => artifact.publish(at),
+      ...artifact.dryRun === undefined ? {} : { dryRun: (at) => artifact.dryRun?.(at) ?? Promise.resolve() }
+    }
+  ];
+}
+function artifactName(artifact) {
+  if (artifact.packages.length > 0) {
+    return `Publish ${artifact.packages.join(" ")}`;
+  }
+  switch (artifact.stage) {
+    case "build":
+      return "Build";
+    case "tag":
+      return "Tag";
+    case "notes":
+      return "Release notes";
+    case "stamp":
+      return "Stamp";
+    default:
+      return "Publish";
+  }
+}
+function statusName(artifact) {
+  return artifact.packages.length > 0 ? artifact.packages.join(" ") : artifact.stage ?? "publish";
+}
+function deadlineFor(stage) {
+  switch (stage) {
+    case "build":
+      return Duration7.mins(10);
+    case "tag":
+    case "notes":
+      return Duration7.mins(2);
+    default:
+      return Duration7.mins(5);
+  }
+}
+function stageRank(step) {
+  return STAGES.indexOf(step.stage === "preflight" ? "publish" : step.stage ?? "publish");
+}
+function declares(declared, packages) {
+  if (declared.length === 0) {
+    throw new Error("no packages are declared: there is nothing to publish");
+  }
+  const drift = [];
+  const byName = new Map(packages.map((pkg) => [pkg.name, pkg]));
+  const names = new Set(declared);
+  for (const name of names) {
+    const pkg = byName.get(name);
+    if (pkg === undefined || pkg.private) {
+      drift.push(`"${name}" is declared but the workspace has no public package by that name`);
+    }
+  }
+  for (const pkg of packages) {
+    if (!pkg.private && !names.has(pkg.name)) {
+      drift.push(`"${pkg.name}" is public but not declared: declare it or mark it private`);
+    }
+  }
+  if (drift.length > 0) {
+    throw new Error(drift.join(`
+`));
+  }
+}
+function confirm(ask, log, packages, version, next, yes = false) {
+  log.info(next.resuming ? `finishing the release of ${version}` : `${next.current} -> ${version} (${next.bump})`);
+  for (const name of packages) {
+    log.info(`  ${name}`);
+  }
+  if (yes) {
+    return true;
+  }
+  const answer = ask(color5.yellow(`publish ${packages.length} packages as ${version}? (y/n)`));
+  return answer?.trim().toLowerCase() === "y";
+}
+// ship/releases.ts
+import { color as color12 } from "../log/index.js";
+import { NodePs as NodePs14 } from "../system/index.js";
+import { Duration as Duration12 } from "../time/index.js";
+
+// ship/bundle/bundle-artifact.ts
+import { color as color6 } from "../log/index.js";
+class BundleArtifact {
+  bundle;
+  packages = [];
+  stage = "build";
+  constructor(bundle = new BunBundle) {
+    this.bundle = bundle;
+  }
+  async publish(cut) {
+    const going = cut.packages.filter((pkg) => !pkg.private);
+    for (const pkg of going) {
+      cut.stage(pkg.name, await this.bundle.build(pkg.dir));
+    }
+    cut.log.info(`${going.length} packages ${color6.green("built")}`);
+  }
+  async clean(cut) {
+    for (const pkg of cut.packages) {
+      await this.bundle.clean(pkg.dir);
+    }
+  }
+}
+
+// ship/git/git-artifact.ts
+import { color as color7 } from "../log/index.js";
+import { NodePs as NodePs10 } from "../system/index.js";
+import { Duration as Duration8 } from "../time/index.js";
+class GitArtifact {
+  name = "git tag";
+  packages = [];
+  stage = "tag";
+  git;
+  constructor(opts = {}) {
+    const ps = opts.ps ?? new NodePs10;
+    this.git = opts.git ?? new CliGit(ps.cwd(), { ps });
+  }
+  steps(cut) {
+    return [
+      {
+        name: "Push branch",
+        deadline: Duration8.mins(2),
+        stage: "tag",
+        run: () => this.pushBranch(),
+        dryRun: async (at) => at.log.info(color7.yellow("would push the branch"))
+      },
+      {
+        name: `Tag ${cut.tag}`,
+        deadline: Duration8.secs(30),
+        stage: "tag",
+        run: async () => this.git.tag(cut.tag),
+        dryRun: async (at) => at.log.info(color7.yellow(`would tag ${at.tag}`))
+      },
+      {
+        name: `Push ${cut.tag}`,
+        deadline: Duration8.mins(2),
+        stage: "tag",
+        run: async () => {
+          await this.git.push(cut.tag);
+          cut.log.info(`${cut.tag} ${color7.green("pushed")}`);
+        },
+        dryRun: async (at) => at.log.info(color7.yellow(`would push ${at.tag}`))
+      }
+    ];
+  }
+  async publish(cut) {
+    await this.pushBranch();
+    await this.git.tag(cut.tag);
+    await this.git.push(cut.tag);
+    cut.log.info(`${cut.tag} ${color7.green("pushed")}`);
+  }
+  async deployed() {
+    const tags = await this.git.remoteTags("v*");
+    return newest(tags.map((tag) => tag.slice(1)));
+  }
+  async pushBranch() {
+    await this.git.push(await this.git.branch());
+  }
+}
+
+// ship/github/cli-github.ts
+import { NodePs as NodePs11 } from "../system/index.js";
+class CliGithub {
+  ps;
+  on;
+  constructor(opts = {}) {
+    this.ps = opts.ps ?? new NodePs11;
+    this.on = opts.repo === undefined ? [] : ["--repo", opts.repo];
+  }
+  get repo() {
+    return this.on[1];
+  }
+  async release(tag) {
+    await this.login();
+    const existing = await this.ps.spawnCapture([
+      "gh",
+      "release",
+      "view",
+      tag,
+      ...this.on
+    ]);
+    if (existing.exitCode === 0) {
+      return;
+    }
+    const { exitCode, stderr } = await this.ps.spawnCapture([
+      "gh",
+      "release",
+      "create",
+      tag,
+      "--generate-notes",
+      ...this.on
+    ]);
+    if (exitCode !== 0) {
+      throw new Error(`gh release create ${tag}: ${stderr.trim()}`);
+    }
+  }
+  async latest() {
+    const { exitCode, stdout, stderr } = await this.ps.spawnCapture([
+      "gh",
+      "release",
+      "view",
+      "--json",
+      "tagName",
+      "--jq",
+      ".tagName",
+      ...this.on
+    ]);
+    if (exitCode === 0) {
+      return stdout.trim() || undefined;
+    }
+    if (stderr.includes("release not found")) {
+      return;
+    }
+    throw new Error(`gh release view: ${stderr.trim() || stdout.trim()}`);
+  }
+  login() {
+    return ghLogin(this.ps);
+  }
+}
+
+// ship/github/github-artifact.ts
+import { color as color8 } from "../log/index.js";
+
+class GithubArtifact {
+  github;
+  name = "GitHub release";
+  packages = [];
+  stage = "notes";
+  constructor(github) {
+    this.github = github;
+  }
+  async publish(cut) {
+    await this.github.release(cut.tag);
+  }
+  async dryRun(cut) {
+    cut.log.info(color8.yellow(`would write the GitHub notes for ${cut.tag}`));
+  }
+  async deployed() {
+    return (await this.github.latest())?.replace(/^v/, "");
+  }
+}
+
+// ship/registry/npm-registry.ts
+import { NodePs as NodePs12 } from "../system/index.js";
+import { Duration as Duration9 } from "../time/index.js";
+
+class NpmRegistry {
+  staged;
+  scans = true;
+  publishDeadline;
+  watch;
+  trust;
+  ps;
+  isTrusted;
+  via;
+  authed;
+  saidSkip = false;
+  constructor(opts = {}) {
+    this.ps = opts.ps ?? new NodePs12;
+    this.isTrusted = opts.trusted === true;
+    this.via = opts.via;
+    this.staged = !this.isTrusted && this.via === undefined;
+    const { via } = this;
+    if (via !== undefined) {
+      this.watch = async (name, version) => via.watch(name, await this.published(name, version));
+      this.publishDeadline = Duration9.mins(30);
+      this.trust = (name, log) => this.trustWorkflow(name, via, log);
+    }
+  }
+  async trustWorkflow(name, via, log) {
+    if (!this.saidSkip) {
+      this.saidSkip = true;
+      log.info("npm asks you to authenticate in a browser: choose to skip two-factor authentication for the next 5 minutes, and the other packages go through without asking");
+    }
+    const argv = [
+      "npm",
+      "trust",
+      "github",
+      name,
+      "--repo",
+      await via.repo(),
+      "--file",
+      via.file,
+      "--allow-publish",
+      "--yes"
+    ];
+    const { exitCode } = await this.ps.spawn(argv);
+    if (exitCode !== 0) {
+      throw new Error(`${argv.join(" ")} failed: if ${name} already trusts another workflow, \`npm trust list ${name}\` shows it and \`npm trust revoke ${name} --id <id>\` clears it`);
+    }
+  }
+  async verify({ name, repository: url = "" }) {
+    if (this.via === undefined) {
+      return;
+    }
+    const expected = `https://github.com/${await this.via.repo()}`;
+    if (sameRepository(url, expected)) {
+      return;
+    }
+    throw new Error(`${name}'s package.json has repository.url ${JSON.stringify(url)}, and npm refuses a publish from ${expected}'s workflow unless it names that repository: set it to "git+${expected}.git"`);
+  }
+  trusted() {
+    return new NpmRegistry({ ps: this.ps, trusted: true });
+  }
+  async pack(dir, into) {
+    const { exitCode, stderr } = await this.ps.spawnCapture(["npm", "pack", "--pack-destination", into], { cwd: dir });
+    if (exitCode !== 0) {
+      throw new Error(`npm pack in ${dir}: ${stderr.trim()}`);
+    }
+  }
+  async published(name, version) {
+    const { exitCode, stdout } = await this.ps.spawnCapture([
+      "npm",
+      "view",
+      `${name}@${version}`,
+      "version"
+    ]);
+    return exitCode === 0 && stdout.trim() !== "";
+  }
+  async deployed(name) {
+    const { exitCode, stdout, stderr } = await this.ps.spawnCapture([
+      "npm",
+      "view",
+      name,
+      "dist-tags.latest"
+    ]);
+    if (exitCode === 0) {
+      return stdout.trim() || undefined;
+    }
+    if (stderr.includes("E404")) {
+      return;
+    }
+    throw new Error(`npm view ${name}: ${stderr.trim() || stdout.trim()}`);
+  }
+  async publish(dir) {
+    if (this.via !== undefined && !this.isTrusted) {
+      await this.via.start();
+      return {};
+    }
+    if (this.isTrusted) {
+      return this.publishTrusted(dir);
+    }
+    this.authed ??= this.checkVersion().then(() => this.login());
+    await this.authed;
+    const { exitCode, stdout, stderr } = await this.ps.spawnCapture(["npm", "stage", "publish", "--access", "public"], { cwd: dir });
+    if (exitCode !== 0) {
+      if (/E409|previously published/i.test(`${stdout}
+${stderr}`)) {
+        return { already: true };
+      }
+      throw new Error(`stage publish failed in ${dir}: ${stderr.trim() || stdout.trim()}`);
+    }
+    const found = /\+ (\S+)@[^@\s]+ \(staged with id ([^)\s]+)\)/.exec(`${stdout}
+${stderr}`);
+    if (found?.[1] === undefined || found[2] === undefined) {
+      throw new Error(`npm staged ${dir} but printed no stage id`);
+    }
+    return {
+      staged: {
+        stageId: found[2],
+        url: `https://www.npmjs.com/package/${found[1]}`
+      }
+    };
+  }
+  async publishTrusted(dir) {
+    const { exitCode, stdout, stderr } = await this.ps.spawnCapture(["npm", "publish", "--access", "public", "--loglevel", "verbose"], { cwd: dir });
+    if (exitCode === 0) {
+      return {};
+    }
+    const output = `${stdout}
+${stderr}`;
+    if (/E409|previously published/i.test(output)) {
+      return { already: true };
+    }
+    if (/OIDC token exchange error/i.test(output)) {
+      throw new Error(`npm refused the OIDC token exchange for ${dir}: the package has no trusted publisher entry naming this repository and workflow, or it does not exist yet`);
+    }
+    throw new Error(`publish failed in ${dir}: ${stderr.trim() || stdout.trim()}`);
+  }
+  page(name, version) {
+    return `https://www.npmjs.com/package/${name}/v/${version}`;
+  }
+  async checkVersion() {
+    const { stdout } = await this.ps.spawnCapture(["npm", "--version"]);
+    const found = /^(\d+)\.(\d+)/.exec(stdout.trim());
+    if (!found) {
+      return;
+    }
+    const [major, minor] = [Number(found[1]), Number(found[2])];
+    if (major < 11 || major === 11 && minor < 15) {
+      throw new Error(`npm ${stdout.trim()} cannot stage packages: npm 11.15 or newer is required (npm install -g npm@latest)`);
+    }
+  }
+  async login() {
+    if ((await this.ps.spawnCapture(["npm", "whoami"])).exitCode === 0) {
+      return;
+    }
+    if (this.ps.env("CI") !== undefined) {
+      throw new Error("not logged in to npm: set NPM_TOKEN");
+    }
+    const { exitCode } = await this.ps.spawn([
+      "npm",
+      "login",
+      "--auth-type=web"
+    ]);
+    if (exitCode !== 0) {
+      throw new Error("npm login failed");
+    }
+  }
+}
+function sameRepository(url, expected) {
+  const normal = url.replace(/^git\+/, "").replace(/\.git$/, "").replace(/^git@github\.com:/, "https://github.com/").replace(/^github:/, "https://github.com/").replace(/^(?=[\w.-]+\/[\w.-]+$)/, "https://github.com/");
+  return normal.toLowerCase() === expected.toLowerCase();
+}
+
+// ship/registry/registry-artifact.ts
+import { color as color9 } from "../log/index.js";
+import { Duration as Duration10 } from "../time/index.js";
+var RUN_CHECK_EVERY = Duration10.secs(5);
+var HELD_AFTER = Duration10.mins(20);
+
+class RegistryArtifact {
+  name;
+  registry;
+  packages;
+  stage = "publish";
+  trust;
+  verify;
+  saidHeld = false;
+  runStatus;
+  constructor(name, registry) {
+    this.name = name;
+    this.registry = registry;
+    this.packages = [name];
+    const { trust } = registry;
+    if (trust !== undefined) {
+      this.trust = (log) => trust.call(registry, name, log);
+    }
+    const { verify } = registry;
+    if (verify !== undefined) {
+      this.verify = async (cut) => {
+        const pkg = cut.packages.find((one) => one.name === name);
+        if (pkg !== undefined) {
+          await verify.call(registry, pkg);
+        }
+      };
+    }
+  }
+  trusted() {
+    const registry = this.registry.trusted?.();
+    return registry === undefined ? this : new RegistryArtifact(this.name, registry);
+  }
+  deployed() {
+    return this.registry.deployed(this.name);
+  }
+  steps(cut) {
+    const publish = {
+      name: `${this.registry.staged ? "Stage" : "Publish"} ${this.name}@${cut.version}`,
+      deadline: this.registry.publishDeadline ?? Duration10.mins(5),
+      stage: "publish",
+      run: (at, report) => this.publish(at, report),
+      dryRun: (at) => this.pack(at),
+      ...this.watching()
+    };
+    if (this.registry.staged !== true && this.registry.scans !== true) {
+      return [publish];
+    }
+    return [
+      publish,
+      {
+        name: `Live ${this.name}@${cut.version}`,
+        deadline: Duration10.hrs(1),
+        stage: "approve",
+        run: async () => {},
+        dryRun: async () => {},
+        check: (at, waited) => this.live(at, waited)
+      }
+    ];
+  }
+  async pack(cut) {
+    const { version, log, dryRun } = cut;
+    const dir = cut.dir(this.name);
+    if (dir === undefined) {
+      throw new Error(`"${this.name}" has no workspace package`);
+    }
+    if (this.registry.pack === undefined || dryRun === undefined) {
+      log.info(`${this.name}@${version} ${color9.yellow("would publish")}`);
+      return;
+    }
+    await this.registry.pack(dir, `${dryRun.dir}/packs`);
+    log.info(`${this.name}@${version} ${color9.green("packed")}`);
+  }
+  watching() {
+    const { watch } = this.registry;
+    if (watch === undefined) {
+      return {};
+    }
+    return {
+      checkEvery: RUN_CHECK_EVERY,
+      check: async ({ version, log }, waited) => {
+        const found = await watch.call(this.registry, this.name, version);
+        if (found.passed) {
+          const after = waited.isEqual(Duration10.zero()) ? "" : ` after ${waited.human()}`;
+          log.info(`${this.name}@${version} ${color9.green("publish run finished")}${after}`);
+          return found;
+        }
+        if (found.status !== this.runStatus) {
+          this.runStatus = found.status;
+          const doing = (found.status ?? "waiting").replaceAll("_", " ");
+          log.info(`${this.name}@${version} publish run ${color9.yellow(doing)}${found.url === undefined ? "" : `: ${found.url}`}`);
+        }
+        return found;
+      }
+    };
+  }
+  async live(cut, waited) {
+    const { version, log } = cut;
+    if (await this.registry.published(this.name, version)) {
+      return { passed: true };
+    }
+    const url = this.registry.page?.(this.name, version);
+    const status = waited.isLessThan(HELD_AFTER) ? "pending" : "held";
+    if (waited.isEqual(Duration10.zero())) {
+      this.saidHeld = false;
+      log.info(`${this.name}@${version} ${color9.yellow("not live yet")}: waiting for ${this.registry.staged === true ? "approval and " : ""}the registry's checks`);
+    } else if (status === "held" && !this.saidHeld) {
+      this.saidHeld = true;
+      log.info(`${this.name}@${version} ${color9.yellow("still not live")} after ${waited.human()}: the registry may be holding it for review${url === undefined ? "" : `, see ${url}`}`);
+    }
+    return { passed: false, status, ...url === undefined ? {} : { url } };
+  }
+  async publish(cut, report) {
+    const { version, log } = cut;
+    if (await this.registry.published(this.name, version)) {
+      log.info(`${this.name}@${version} ${color9.green("already published")}`);
+      return;
+    }
+    const dir = cut.dir(this.name);
+    if (dir === undefined) {
+      throw new Error(`"${this.name}" has no workspace package`);
+    }
+    const { already, staged } = await this.registry.publish(dir);
+    if (already === true) {
+      log.info(`${this.name}@${version} ${color9.green("already accepted")}: the registry took it on an earlier run`);
+      return;
+    }
+    if (staged === undefined) {
+      log.info(this.registry.watch === undefined ? `${this.name}@${version} ${color9.green("published")}` : `${this.name}@${version} ${color9.green("publish run started")}`);
+      return;
+    }
+    log.info(`${this.name}@${version} ${color9.green("staged")}: approve ${staged.stageId} at ${staged.url}`);
+    await report?.staged({ package: this.name, version, ...staged });
+  }
+}
+
+// ship/shipped.ts
+import { relative as relative5 } from "node:path";
+import { color as color10 } from "../log/index.js";
+import { NodeFs as NodeFs9, NodePs as NodePs13 } from "../system/index.js";
+import { Duration as Duration11 } from "../time/index.js";
+var FIELDS2 = ["dependencies", "peerDependencies"];
+
+class ShippedCheck {
+  opts;
+  name = "Dependencies shipped";
+  deadline = Duration11.mins(1);
+  stage = "preflight";
+  fs;
+  ps;
+  constructor(opts) {
+    this.opts = opts;
+    this.fs = opts.fs ?? new NodeFs9;
+    this.ps = opts.ps ?? new NodePs13;
+  }
+  async run(cut) {
+    const unshipped = await this.unshipped(cut);
+    if (unshipped.length === 0) {
+      return;
+    }
+    this.list(cut, unshipped);
+    const ask = this.opts.prompt ?? prompt;
+    const answer = ask("go ahead without shipping them first? [y/N]");
+    if (answer?.trim().toLowerCase() !== "y") {
+      throw new Error(`ship ${unshipped.map((one) => one.project).join(", ")} first`);
+    }
+  }
+  async dryRun(cut) {
+    const unshipped = await this.unshipped(cut);
+    if (unshipped.length > 0) {
+      this.list(cut, unshipped);
+      cut.log.info(color10.yellow("a release would ask whether to go ahead"));
+    }
+  }
+  async unshipped(cut) {
+    const workspace = this.opts.workspace ?? await ManifestWorkspace.at(cut.root, { fs: this.fs, ps: this.ps });
+    const root = workspace.root;
+    const packages = await workspace.packages();
+    const inside = (dir, project) => dir === `${root}/${project}` || dir.startsWith(`${root}/${project}/`);
+    const own = packages.filter((pkg) => !pkg.private && inside(pkg.dir, this.opts.project));
+    const needed = new Set;
+    for (const pkg of own) {
+      const manifest = await manifestAt(this.fs, pkg.dir);
+      for (const field of FIELDS2) {
+        for (const [name, range] of Object.entries(manifest[field] ?? {})) {
+          if (range.startsWith("workspace:")) {
+            needed.add(name);
+          }
+        }
+      }
+    }
+    const found = [];
+    for (const pkg of packages) {
+      if (!needed.has(pkg.name) || pkg.private || inside(pkg.dir, this.opts.project)) {
+        continue;
+      }
+      const project = relative5(root, pkg.dir).split("/")[0];
+      const release = await this.git(root, "log", "-1", "--format=%H", "-G", '"version":', "--", `${relative5(root, pkg.dir)}/package.json`);
+      const commits = await this.git(root, "log", "--format=%h %s", ...release === "" ? ["HEAD"] : [`${release}..HEAD`], "--", relative5(root, pkg.dir));
+      if (commits !== "") {
+        found.push({ name: pkg.name, project, commits: commits.split(`
+`) });
+      }
+    }
+    return found;
+  }
+  list(cut, unshipped) {
+    for (const one of unshipped) {
+      cut.log.info(`${one.name} ${color10.yellow("has changes not yet shipped")}, so this release would go out against the version the registry has, without them:`);
+      for (const commit of one.commits) {
+        cut.log.info(`  ${commit}`);
+      }
+    }
+  }
+  async git(cwd, ...args) {
+    const result = await this.ps.spawnCapture(["git", ...args], { cwd });
+    if (result.exitCode !== 0) {
+      throw new Error(`git ${args.join(" ")} failed in ${cwd}: ${result.stderr.trim()}`);
+    }
+    return result.stdout.trim();
+  }
+}
+
+// ship/skill-artifact.ts
+import { resolve as resolve3 } from "node:path";
+import { color as color11 } from "../log/index.js";
+import { NodeFs as NodeFs10 } from "../system/index.js";
+var FRONTMATTER = /^---\n[\s\S]*?\n---/;
+var VERSION = /^version:.*$/m;
+
+class SkillArtifact {
+  path;
+  packages = [];
+  stage = "stamp";
+  fs;
+  constructor(path, opts = {}) {
+    this.path = path;
+    this.fs = opts.fs ?? new NodeFs10;
+  }
+  async publish(cut) {
+    const path = resolve3(cut.root, this.path);
+    const stamped = stamp(await this.fs.read(path), cut.version, this.path);
+    await this.fs.write(path, stamped);
+    cut.log.info(`${this.path} ${color11.green(`stamped ${cut.version}`)}`);
+  }
+}
+function stamp(doc, version, path) {
+  const front = FRONTMATTER.exec(doc)?.[0];
+  if (front === undefined || !VERSION.test(front)) {
+    throw new Error(`${path} has no "version:" line in its frontmatter: add one for the release to stamp`);
+  }
+  return front.replace(VERSION, () => `version: ${version}`) + doc.slice(front.length);
+}
+
+// ship/releases.ts
+class releases {
+  constructor() {}
+  static npm(name, opts = {}) {
+    return new Release([new RegistryArtifact(name, new NpmRegistry(opts))]);
+  }
+  static custom(name, registry) {
+    return new Release([new RegistryArtifact(name, registry)]);
+  }
+  static step(step) {
+    return new Release([], [step]);
+  }
+  static shipped(opts) {
+    return releases.step(new ShippedCheck(opts));
+  }
+  static push(opts = {}) {
+    return releases.step({
+      name: "Push commits",
+      deadline: Duration12.mins(2),
+      stage: "preflight",
+      run: async (cut) => {
+        const git = opts.git ?? new CliGit(cut.root, { ps: opts.ps });
+        await git.push(await git.branch());
+      },
+      dryRun: async (cut) => {
+        cut.log.info(color12.yellow("would push the branch's commits"));
+      }
+    });
+  }
+  static publishWorkflow(opts) {
+    const workflow = new PublishWorkflow(opts);
+    return releases.step({
+      name: "Publish workflow",
+      deadline: Duration12.secs(30),
+      stage: "preflight",
+      run: async (cut) => {
+        if (await workflow.write(cut.root)) {
+          cut.log.info("wrote the publish workflow: commit it with the release");
+        }
+      }
+    });
+  }
+  static git(opts = {}) {
+    return new Release([new GitArtifact(opts)]);
+  }
+  static build(bundle) {
+    return new Release([new BundleArtifact(bundle)]);
+  }
+  static vendor(opts = {}) {
+    return new Release([new BundleArtifact(new VendorBundle(opts))]);
+  }
+  static mirror(opts) {
+    return releases.step(new MirrorStep(opts));
+  }
+  static mirrored(opts) {
+    return new Release([new MirrorBuild(opts)]);
+  }
+  static skill(path, opts = {}) {
+    return new Release([new SkillArtifact(path, opts)]);
+  }
+  static github(opts = {}) {
+    return new Release([new GithubArtifact(new CliGithub(opts))]);
+  }
+  static lockstep(...declarations) {
+    const artifacts = [];
+    const steps = [];
+    for (const declaration of declarations) {
+      if (declaration instanceof Release) {
+        artifacts.push(...declaration.artifacts);
+        steps.push(...declaration.steps);
+      } else if ("run" in declaration) {
+        steps.push(declaration);
+      } else {
+        artifacts.push(declaration);
+      }
+    }
+    return new Release(artifacts, steps);
+  }
+  static async workspace(opts = {}) {
+    const ps = opts.ps ?? new NodePs14;
+    const workspace = await ManifestWorkspace.at(ps.cwd(), {
+      fs: opts.fs,
+      ps,
+      project: opts.project
+    });
+    const registry = new NpmRegistry({ ps, via: opts.via });
+    const artifacts = (await workspace.packages()).filter((pkg) => !pkg.private).map((pkg) => new RegistryArtifact(pkg.name, registry));
+    return new Release([
+      new BundleArtifact(new BunBundle({ fs: opts.fs, ps })),
+      ...artifacts,
+      new GitArtifact({ git: new CliGit(workspace.root, { ps }) }),
+      new GithubArtifact(new CliGithub({ ps }))
+    ]);
+  }
+}
+export {
+  Cut,
+  GithubActions,
+  ManifestWorkspace,
+  MirrorBuild,
+  MirrorStep,
+  PUBLISH_WORKFLOW_PATH,
+  PublishWorkflow,
+  Release,
+  ShippedCheck,
+  VendorBundle,
+  githubActions,
+  order,
+  published,
+  releases
+};