aronrepo 3.0.0 → 3.0.2

package/dist/commands-ClWK0lQ9.js

@@ -0,0 +1,1688 @@
+import { agentsBlockEnd, agentsBlockStart, commits, createReleasePathMatcher, defaultReleasePathExcludes, getAgentCommitPolicy, getBaseTag, getNextVersion, getReleaseChannel, getReleasePolicy, getReleaseTable, getReleaseType, legacyCommits, parseCommit, parseVersionTag, renderAgentsBlock, renderReleaseNotes, resolveCommitRelease, resolveRelease, toVersionTag } from "./index.js";
+import semver from "semver";
+import { execFileSync, spawn } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { globSync } from "tinyglobby";
+import { load } from "js-yaml";
+import os from "node:os";
+import { gunzipSync } from "node:zlib";
+// src/project.ts
+/** Config files in lookup order. Node 22.18+ imports `.ts` files by stripping their types. */
+const configFileNames = [
+	"aronrepo.config.js",
+	"aronrepo.config.mjs",
+	"aronrepo.config.cjs",
+	"aronrepo.config.ts",
+	"aronrepo.config.mts",
+	"aronrepo.config.cts"
+];
+function toPosixPath(value) {
+	return value.split(path.sep).join("/");
+}
+/** Reads JSON like npm does, accepting a UTF-8 byte order mark, and names the file when it is invalid. */
+function readJsonFile(file) {
+	const content = fs.readFileSync(file, "utf8").replace(/^\uFEFF/, "");
+	try {
+		return JSON.parse(content);
+	} catch (error) {
+		throw new Error(`${file} is not valid JSON: ${error.message}`, { cause: error });
+	}
+}
+const readJson$1 = readJsonFile;
+function findConfigFile(cwd = process.cwd()) {
+	return configFileNames.map((name) => path.join(cwd, name)).find((file) => fs.existsSync(file));
+}
+/** Loads `aronrepo.config.js` from the repository root; returns `{}` when it is missing. */
+async function loadConfig(cwd = process.cwd()) {
+	const file = findConfigFile(cwd);
+	if (!file) return {};
+	const stat = fs.statSync(file);
+	return (await import(`${pathToFileURL(file).href}?mtime=${stat.mtimeMs}&size=${stat.size}`)).default ?? {};
+}
+function readPNPMWorkspaces(cwd) {
+	const workspacePath = path.join(cwd, "pnpm-workspace.yaml");
+	if (!fs.existsSync(workspacePath)) return void 0;
+	const content = fs.readFileSync(workspacePath, "utf8");
+	if (!content.split("\n").some((line) => line.trim() && !line.trim().startsWith("#"))) return void 0;
+	return load(content)?.packages;
+}
+function readNPMWorkspaces(cwd) {
+	const packagePath = path.join(cwd, "package.json");
+	if (!fs.existsSync(packagePath)) return void 0;
+	const pkg = readJson$1(packagePath);
+	return Array.isArray(pkg.workspaces) ? pkg.workspaces : pkg.workspaces?.packages;
+}
+function readWorkspacePatterns(cwd = process.cwd()) {
+	return readPNPMWorkspaces(cwd) ?? readNPMWorkspaces(cwd) ?? [];
+}
+function queryWorkspaceDirs(patterns, cwd = process.cwd()) {
+	if (!patterns.length) return [];
+	return globSync(patterns.map((workspace) => `${workspace}/package.json`), {
+		cwd,
+		onlyFiles: true,
+		expandDirectories: false,
+		ignore: ["**/node_modules/**"]
+	}).map((workspacePackage) => toPosixPath(workspacePackage).replace(/\/?package\.json$/, "") || ".").sort();
+}
+function readWorkspacePackage(cwd, workspace) {
+	return readJson$1(path.join(cwd, workspace, "package.json"));
+}
+/**
+* Directories of the packages that ship: public, non-private workspace packages,
+* and the root package when it is published too. A root package without
+* workspaces ships unless it is private; with workspaces it needs
+* `publishConfig.access: "public"` like the others.
+*/
+function queryReleaseDirs(cwd = process.cwd()) {
+	const dirs = queryPublicWorkspaceDirs(cwd);
+	const rootFile = path.join(cwd, "package.json");
+	if (dirs.includes(".") || !fs.existsSync(rootFile)) return dirs;
+	const root = readJson$1(rootFile);
+	const hasWorkspaces = readWorkspacePatterns(cwd).length > 0;
+	if (root.name && !root.private && (!hasWorkspaces || root.publishConfig?.access === "public")) return [".", ...dirs];
+	return dirs;
+}
+/** Workspace directories whose package is published to npm: public and not private. */
+function queryPublicWorkspaceDirs(cwd = process.cwd()) {
+	return queryWorkspaceDirs(readWorkspacePatterns(cwd), cwd).filter((workspace) => {
+		const pkg = readWorkspacePackage(cwd, workspace);
+		return pkg.publishConfig?.access === "public" && !pkg.private;
+	});
+}
+/**
+* Resolves the files whose changes can release a version.
+*
+* Configured paths win. Otherwise public workspace packages define them; a
+* single-package repository with a non-private root package uses every path.
+* Returns `undefined` when no published package is found, which turns the check off.
+*/
+function resolveReleasePaths(cwd = process.cwd(), policy) {
+	if (policy?.paths === false) return void 0;
+	if (policy?.paths?.include) return {
+		include: policy.paths.include,
+		exclude: policy.paths.exclude ?? defaultReleasePathExcludes
+	};
+	const exclude = policy?.paths?.exclude ?? defaultReleasePathExcludes;
+	const dirs = queryReleaseDirs(cwd);
+	if (!dirs.length) return void 0;
+	return {
+		include: dirs.includes(".") ? ["**"] : dirs.map((dir) => `${dir}/**`),
+		exclude
+	};
+}
+const lockfiles = [
+	["bun.lock", "bun"],
+	["bun.lockb", "bun"],
+	["pnpm-lock.yaml", "pnpm"],
+	["pnpm-workspace.yaml", "pnpm"],
+	["yarn.lock", "yarn"],
+	["package-lock.json", "npm"]
+];
+/** The package manager from `packageManager` in package.json, then from the lockfile; `npm` by default. */
+function detectPackageManager(cwd = process.cwd()) {
+	const rootPackage = path.join(cwd, "package.json");
+	const declared = fs.existsSync(rootPackage) ? String(readJson$1(rootPackage).packageManager ?? "").split("@")[0] : "";
+	if (declared === "bun" || declared === "pnpm" || declared === "yarn" || declared === "npm") return declared;
+	return lockfiles.find(([file]) => fs.existsSync(path.join(cwd, file)))?.[1] ?? "npm";
+}
+/** How to run the aronrepo CLI with a package manager. */
+function getCliCommand(packageManager) {
+	return {
+		bun: "bun x aronrepo",
+		pnpm: "pnpm exec aronrepo",
+		yarn: "yarn aronrepo",
+		npm: "npx aronrepo"
+	}[packageManager];
+}
+/**
+* How to run the aronrepo CLI in a repository: its `aronrepo` script when it has
+* one, for example a workspace that builds aronrepo itself, or the installed binary.
+*/
+function getProjectCliCommand(cwd, packageManager = detectPackageManager(cwd)) {
+	const rootPackage = path.join(cwd, "package.json");
+	if ((fs.existsSync(rootPackage) ? readJson$1(rootPackage).scripts : void 0)?.aronrepo) return packageManager === "npm" ? "npm run aronrepo --" : `${packageManager} run aronrepo`;
+	return getCliCommand(packageManager);
+}
+/** Loads the config, release policy, and release paths of a repository. */
+async function loadProjectPolicy(cwd = process.cwd(), overrides = {}) {
+	const config = await loadConfig(cwd);
+	const policy = {
+		...getReleasePolicy(config),
+		...overrides
+	};
+	const releasePaths = resolveReleasePaths(cwd, policy);
+	const configFile = findConfigFile(cwd);
+	const packageManager = detectPackageManager(cwd);
+	return {
+		cwd,
+		packageManager,
+		cli: getProjectCliCommand(cwd, packageManager),
+		config,
+		...configFile ? { configFile } : {},
+		policy,
+		...releasePaths ? { releasePaths } : {},
+		...releasePaths ? { isReleasePath: createReleasePathMatcher(releasePaths) } : {}
+	};
+}
+function git$1(cwd, args) {
+	if (!fs.existsSync(cwd)) throw new Error(`${cwd} does not exist.`);
+	try {
+		return execFileSync("git", args, {
+			cwd,
+			encoding: "utf8",
+			maxBuffer: 67108864,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+	} catch (error) {
+		const { stderr, code } = error;
+		if (code === "ENOENT") throw new Error("git is not installed or not on PATH.", { cause: error });
+		throw new Error(`\`git ${args.join(" ")}\` failed: ${stderr?.trim() || error.message}`, { cause: error });
+	}
+}
+/** The repository root that contains `cwd`, or `cwd` itself outside a git repository. */
+function getRepositoryRoot(cwd = process.cwd()) {
+	try {
+		return git$1(cwd, ["rev-parse", "--show-toplevel"]).trim() || cwd;
+	} catch {
+		return cwd;
+	}
+}
+/** A git config value, or `undefined` when it is not set. */
+function getGitConfig(cwd, key) {
+	try {
+		return git$1(cwd, [
+			"config",
+			"--get",
+			key
+		]).trim() || void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* NUL-separated paths. `-z` keeps git from quoting paths with non-ASCII or
+* special characters, such as `"docs/\\346\\226\\207.md"`, which would never
+* match a release path.
+*/
+function splitPaths(output) {
+	return output.split("\0").map((file) => file.replace(/^\n/, "")).filter(Boolean);
+}
+const nameOnly = [
+	"--name-only",
+	"-z",
+	"--no-renames"
+];
+/** Files changed by one commit. Merge commits report no files. */
+function getCommitFiles(cwd, hash) {
+	return splitPaths(git$1(cwd, [
+		"diff-tree",
+		"--no-commit-id",
+		...nameOnly,
+		"-r",
+		"--root",
+		hash
+	]));
+}
+function getStagedFiles(cwd = process.cwd()) {
+	return splitPaths(git$1(cwd, [
+		"diff",
+		"--cached",
+		...nameOnly
+	]));
+}
+/** Files changed between the merge base of `base` and `head`, like a pull request diff. */
+function getDiffFiles(cwd, base, head) {
+	return splitPaths(git$1(cwd, [
+		"diff",
+		...nameOnly,
+		`${base}...${head}`
+	]));
+}
+/** Commits in `from..to`, oldest first, with their changed files, from one `git log`. Merge commits report no files. */
+function getRangeCommits(cwd, from, to = "HEAD") {
+	const range = from ? `${from}..${to}` : to;
+	return git$1(cwd, [
+		"-c",
+		"log.showSignature=false",
+		"log",
+		"--reverse",
+		"--no-color",
+		...nameOnly,
+		"--format=%x1e%H%x1f%B%x1f",
+		range,
+		"--"
+	]).split("").filter((entry) => entry.includes("")).map((entry) => {
+		const hashEnd = entry.indexOf("");
+		const messageEnd = entry.indexOf("", hashEnd + 1);
+		return {
+			hash: entry.slice(0, hashEnd),
+			message: entry.slice(hashEnd + 1, messageEnd).trim(),
+			files: splitPaths(entry.slice(messageEnd + 1))
+		};
+	});
+}
+/**
+* Latest `v*` version tag reachable from `ref`, or `undefined` when there is none.
+* A tag on `ref` itself does not count, so `explain --to v1.1.0` explains v1.1.0.
+*/
+function getLatestTag(cwd, ref = "HEAD") {
+	try {
+		return git$1(cwd, [
+			"describe",
+			"--tags",
+			"--abbrev=0",
+			"--match",
+			"v[0-9]*",
+			`${ref}^`
+		]).trim() || void 0;
+	} catch {
+		return;
+	}
+}
+/** `v*` tags, optionally only those merged into `ref`; none when `ref` does not exist, such as the parent of a root commit. */
+function getVersionTags(cwd, mergedInto) {
+	try {
+		return splitPaths(git$1(cwd, [
+			"tag",
+			"--list",
+			"v*",
+			...mergedInto ? ["--merged", mergedInto] : []
+		]).replace(/\n/g, "\0"));
+	} catch {
+		return [];
+	}
+}
+/** The checked-out branch, or `undefined` on a detached HEAD. */
+function getCurrentBranch(cwd) {
+	const branch = git$1(cwd, [
+		"rev-parse",
+		"--abbrev-ref",
+		"HEAD"
+	]).trim();
+	return branch === "HEAD" ? void 0 : branch;
+}
+/** Resolves the release of a commit range with the repository's policy and release paths. */
+async function explainRange(cwd, from, to = "HEAD", overrides = {}) {
+	const project = await loadProjectPolicy(cwd, overrides);
+	const commits = getRangeCommits(cwd, from, to);
+	return {
+		...project,
+		from,
+		to,
+		...resolveRelease(commits, project.policy, project.isReleasePath ? { isReleasePath: project.isReleasePath } : {})
+	};
+}
+// src/release.ts
+const officialRegistry = "https://registry.npmjs.org/";
+/** npm dist-tag that holds a release until every package of it is published. */
+const stagingDistTag = "aronrepo-staging";
+/** GitHub rejects release bodies over 125,000 characters. */
+const releaseBodyLimit = 12e4;
+/** Quotes an argument for `cmd.exe`, which runs `.cmd` shims such as `npm.cmd` on Windows. */
+function quoteWindowsArg(arg) {
+	if (/^[\w@+=:,./\\-]+$/.test(arg)) return arg;
+	return `"${arg.replace(/(\\*)"/g, "$1$1\\\"").replace(/(\\+)$/, "$1$1")}"`;
+}
+const runCommand = (command, args, { cwd, env }) => new Promise((resolve, reject) => {
+	const child = process.platform === "win32" ? spawn([command, ...args].map(quoteWindowsArg).join(" "), {
+		cwd,
+		env,
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		],
+		shell: true
+	}) : spawn(command, args, {
+		cwd,
+		env,
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	let stdout = "";
+	let stderr = "";
+	child.stdout.on("data", (chunk) => {
+		stdout += chunk;
+	});
+	child.stderr.on("data", (chunk) => {
+		stderr += chunk;
+	});
+	child.on("error", reject);
+	child.on("close", (code, signal) => {
+		if (code === 0) resolve({
+			stdout,
+			stderr
+		});
+		else reject(/* @__PURE__ */ new Error(`\`${command} ${args.join(" ")}\` ${signal ? `was stopped by ${signal}` : `exited with ${code}`}.\n${stderr.trim() || stdout.trim()}`));
+	});
+});
+function createEnvironment(options = {}) {
+	return {
+		cwd: options.cwd ?? process.cwd(),
+		env: options.env ?? process.env,
+		run: options.run ?? runCommand,
+		fetch: options.fetch ?? ((input, init) => fetch(input, init)),
+		log: options.log ?? ((message) => console.log(message)),
+		wait: options.wait ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)))
+	};
+}
+/** Variables that hold credentials. Package scripts that run while packing never see them. */
+const secretVariables = [
+	"NPM_TOKEN",
+	"NODE_AUTH_TOKEN",
+	"NPM_ID_TOKEN",
+	"GITHUB_TOKEN",
+	"GH_TOKEN",
+	"ACTIONS_ID_TOKEN_REQUEST_TOKEN",
+	"ACTIONS_ID_TOKEN_REQUEST_URL",
+	"ACTIONS_RUNTIME_TOKEN"
+];
+function withoutSecrets(env) {
+	return Object.fromEntries(Object.entries(env).filter(([key]) => !secretVariables.includes(key.toUpperCase())));
+}
+async function git(environment, args) {
+	return (await environment.run("git", args, {
+		cwd: environment.cwd,
+		env: environment.env
+	})).stdout.trim();
+}
+async function gitSucceeds(environment, args) {
+	try {
+		await git(environment, args);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function lines(output) {
+	return output.split("\n").map((line) => line.trim()).filter(Boolean);
+}
+const readJson = readJsonFile;
+const dependencyFields = [
+	"dependencies",
+	"optionalDependencies",
+	"peerDependencies"
+];
+/** Fields whose packages must be published first; peers only need to exist when installed. */
+const orderFields = ["dependencies", "optionalDependencies"];
+/** Published packages of the repository in dependency order. */
+function getReleasePackages(cwd) {
+	const packages = queryReleaseDirs(cwd).map((dir) => {
+		const manifest = readJson(path.join(cwd, dir, "package.json"));
+		if (!manifest.name) throw new Error(`${dir}/package.json has no name.`);
+		return {
+			dir,
+			name: manifest.name,
+			manifest
+		};
+	});
+	const names = /* @__PURE__ */ new Map();
+	for (const { dir, name } of packages) {
+		if (names.has(name)) throw new Error(`${names.get(name)}/package.json and ${dir}/package.json are both named ${name}.`);
+		names.set(name, dir);
+	}
+	const dependenciesOf = (pkg) => orderFields.flatMap((field) => Object.keys(pkg.manifest[field] ?? {})).filter((name) => names.has(name) && name !== pkg.name);
+	const ordered = [];
+	const visiting = /* @__PURE__ */ new Set();
+	const visit = (pkg) => {
+		if (ordered.includes(pkg)) return;
+		if (visiting.has(pkg.name)) throw new Error(`Published packages depend on each other in a cycle through ${pkg.name}.`);
+		visiting.add(pkg.name);
+		for (const name of dependenciesOf(pkg)) visit(packages.find((candidate) => candidate.name === name));
+		visiting.delete(pkg.name);
+		ordered.push(pkg);
+	};
+	for (const pkg of [...packages].sort((a, b) => a.dir.localeCompare(b.dir))) visit(pkg);
+	return ordered;
+}
+/**
+* The repository URL on GitHub, from `GITHUB_REPOSITORY` or the root package.json.
+* `owner/repo` and `github:owner/repo` are npm shorthands for GitHub.
+*/
+function getRepositoryUrl(cwd, env = process.env) {
+	if (env.GITHUB_REPOSITORY) return `${(env.GITHUB_SERVER_URL ?? "https://github.com").replace(/\/+$/, "")}/${env.GITHUB_REPOSITORY}`;
+	const root = path.join(cwd, "package.json");
+	if (!fs.existsSync(root)) return void 0;
+	const repository = readJson(root).repository;
+	const url = (typeof repository === "string" ? repository : repository?.url)?.replace(/#.*$/, "");
+	if (!url) return void 0;
+	const match = /^(?:github:)?([\w.-]+\/[\w.-]+?)(?:\.git)?$/.exec(url) ?? /(?:^|[/@])github\.com[/:]([^/]+\/[^/]+?)(?:\.git)?\/?$/.exec(url);
+	return match ? `https://github.com/${match[1]}` : void 0;
+}
+async function getBranch(environment, branch) {
+	if (branch) return branch;
+	const checkedOut = await git(environment, [
+		"rev-parse",
+		"--abbrev-ref",
+		"HEAD"
+	]);
+	const ref = environment.env.GITHUB_REF_NAME;
+	if (!ref) return checkedOut;
+	if (checkedOut !== "HEAD" && checkedOut !== ref) throw new Error(`GITHUB_REF_NAME is ${ref}, but ${checkedOut} is checked out. Pass --branch to choose the release branch.`);
+	return ref;
+}
+function renderPlanNotes(environment, plan, version, date) {
+	const repositoryUrl = getRepositoryUrl(environment.cwd, environment.env);
+	return renderReleaseNotes({
+		version,
+		...plan.from ? { previousTag: plan.from } : {},
+		date: date ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
+		...repositoryUrl ? { repositoryUrl } : {},
+		commits: plan.commits
+	});
+}
+/** Plans the next release of the checked-out commit without changing anything. */
+async function planRelease(options = {}, environmentOptions = {}) {
+	const environment = createEnvironment(environmentOptions);
+	const { cwd } = environment;
+	const project = await loadProjectPolicy(cwd, options.mode ? { mode: options.mode } : {});
+	const branch = await getBranch(environment, options.branch);
+	const channel = getReleaseChannel(branch) ?? (options.fallbackToMain ? getReleaseChannel("main") : void 0);
+	const head = await git(environment, ["rev-parse", "HEAD"]);
+	const packages = getReleasePackages(cwd);
+	const base = {
+		branch,
+		head,
+		mode: project.policy.mode,
+		release: false,
+		commits: [],
+		packages
+	};
+	if (!channel) return base;
+	if (await git(environment, ["rev-parse", "--is-shallow-repository"]) === "true") throw new Error("The repository is a shallow clone, so its tags and commits are incomplete. Fetch the full history, such as `fetch-depth: 0` in actions/checkout.");
+	const ignored = new Set(options.ignoreTags ?? []);
+	const reachable = lines(await git(environment, [
+		"tag",
+		"--list",
+		"v*",
+		"--merged",
+		"HEAD"
+	])).filter((tag) => !ignored.has(tag));
+	const all = lines(await git(environment, [
+		"tag",
+		"--list",
+		"v*"
+	])).filter((tag) => !ignored.has(tag));
+	const from = getBaseTag(channel, reachable);
+	const decision = resolveRelease(getRangeCommits(cwd, from, "HEAD"), project.policy, project.isReleasePath ? { isReleasePath: project.isReleasePath } : {});
+	const plan = {
+		...base,
+		channel,
+		...from ? { from } : {},
+		release: decision.release,
+		commits: decision.commits
+	};
+	if (!decision.release) return plan;
+	const version = options.version ?? getNextVersion(channel, decision.release, {
+		reachable,
+		all
+	});
+	return {
+		...plan,
+		version,
+		tag: toVersionTag(version),
+		notes: renderPlanNotes(environment, plan, version, options.date)
+	};
+}
+/** `.npmrc` content that applies in a repository: the project file, then the user file, as npm reads them. */
+function readNpmConfigs(cwd, env) {
+	const userconfig = env.NPM_CONFIG_USERCONFIG ?? env.npm_config_userconfig ?? path.join(os.homedir(), ".npmrc");
+	return {
+		project: readNpmrc(path.join(cwd, ".npmrc")),
+		user: readNpmrc(userconfig)
+	};
+}
+/** The last value of an `.npmrc` key, with `${VAR}` and `${VAR?}` expanded, or `undefined`. */
+function readNpmrcValue(content, key, env) {
+	let value;
+	for (const line of content.split(/\r?\n/)) {
+		const trimmed = line.trim();
+		if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith(";")) continue;
+		const index = trimmed.indexOf("=");
+		if (index === -1 || trimmed.slice(0, index).trim() !== key) continue;
+		value = trimmed.slice(index + 1).trim().replace(/^(['"])(.*)\1$/, "$2").replace(/\$\{([^}?]+)\??\}/g, (_, name) => env[name] ?? "");
+	}
+	return value;
+}
+/**
+* Registry of a package, in npm's order: `publishConfig` (scoped, then plain),
+* the `@scope:registry` of `.npmrc` or the environment, `npm_config_registry`,
+* the `registry` of `.npmrc`, then npm. Pass `npmrc` to read `.npmrc` settings.
+*/
+function getRegistry(manifest, env = process.env, npmrc = "") {
+	const scope = manifest.name?.startsWith("@") ? manifest.name.split("/")[0] : void 0;
+	const configured = [
+		scope ? manifest.publishConfig?.[`${scope}:registry`] : void 0,
+		manifest.publishConfig?.registry,
+		scope ? env[`npm_config_${scope}:registry`] ?? env[`NPM_CONFIG_${scope}:registry`] : void 0,
+		scope ? readNpmrcValue(npmrc, `${scope}:registry`, env) : void 0,
+		env.NPM_CONFIG_REGISTRY ?? env.npm_config_registry,
+		readNpmrcValue(npmrc, "registry", env)
+	].find((value) => typeof value === "string" && value);
+	const registry = typeof configured === "string" ? configured : officialRegistry;
+	return registry.endsWith("/") ? registry : `${registry}/`;
+}
+function nerfDart(registry) {
+	const url = new URL(registry);
+	return `//${url.host}${url.pathname.endsWith("/") ? url.pathname : `${url.pathname}/`}`;
+}
+function isTransient(status) {
+	return status === 408 || status === 429 || status >= 500;
+}
+async function readPackument(environment, registry, name) {
+	const headers = {
+		accept: "application/json",
+		"cache-control": "no-cache"
+	};
+	if (registry !== "https://registry.npmjs.org/" && environment.env.NPM_TOKEN) headers.authorization = `Bearer ${environment.env.NPM_TOKEN}`;
+	for (let attempt = 1;; attempt++) {
+		let response;
+		try {
+			response = await environment.fetch(`${registry}${name.replace("/", "%2f")}`, { headers });
+		} catch (error) {
+			if (attempt >= 4) throw new Error(`Could not read ${name} from ${registry}: ${error.message}`, { cause: error });
+			await environment.wait(2e3 * attempt);
+			continue;
+		}
+		if (response.status === 404) return void 0;
+		if (response.ok) return await response.json();
+		if (!isTransient(response.status) || attempt >= 4) throw new Error(`Could not read ${name} from ${registry}: ${response.status} ${response.statusText}`);
+		await environment.wait(2e3 * attempt);
+	}
+}
+async function getGitHubIdToken(environment, audience) {
+	const { ACTIONS_ID_TOKEN_REQUEST_URL: url, ACTIONS_ID_TOKEN_REQUEST_TOKEN: token } = environment.env;
+	if (!url || !token) return void 0;
+	const response = await environment.fetch(`${url}${url.includes("?") ? "&" : "?"}audience=${encodeURIComponent(audience)}`, { headers: {
+		authorization: `Bearer ${token}`,
+		accept: "application/json"
+	} });
+	if (!response.ok) {
+		environment.log(`! Could not get a GitHub Actions OIDC token: ${response.status} ${response.statusText}`);
+		return;
+	}
+	return (await response.json()).value;
+}
+/** Exchanges a GitHub Actions OIDC token for a short-lived npm publish token (npm trusted publishing). */
+async function exchangeOidcToken(environment, name, registry) {
+	if (registry !== "https://registry.npmjs.org/") return void 0;
+	const identity = environment.env.NPM_ID_TOKEN || await getGitHubIdToken(environment, "npm:registry.npmjs.org");
+	if (!identity) return void 0;
+	const response = await environment.fetch(`${officialRegistry}-/npm/v1/oidc/token/exchange/package/${name.replace("/", "%2f")}`, {
+		method: "POST",
+		headers: { authorization: `Bearer ${identity}` }
+	});
+	if (!response.ok) {
+		environment.log(`! Could not exchange the OIDC token for ${name}: ${response.status} ${response.statusText}`);
+		return;
+	}
+	return (await response.json()).token;
+}
+function readNpmrc(file) {
+	return fs.existsSync(file) ? fs.readFileSync(file, "utf8") : "";
+}
+/** actions/setup-node writes `_authToken=${NODE_AUTH_TOKEN}` and sets this placeholder when no token is given. */
+const placeholderToken = "XXXXX-XXXXX-XXXXX-XXXXX";
+/**
+* Auth for the registry in `.npmrc` content: `valid`, `invalid` (an unset
+* `${VAR}` or the setup-node placeholder), or `undefined` when there is none.
+* npm 9+ rejects auth without a registry prefix, so only `//host/path/:` keys count.
+*/
+function readRegistryAuth(content, registry, env) {
+	const nerfed = nerfDart(registry);
+	const usable = (value) => value === void 0 ? void 0 : Boolean(value) && value !== placeholderToken;
+	const token = usable(readNpmrcValue(content, `${nerfed}:_authToken`, env));
+	const auth = usable(readNpmrcValue(content, `${nerfed}:_auth`, env));
+	const username = usable(readNpmrcValue(content, `${nerfed}:username`, env));
+	const password = usable(readNpmrcValue(content, `${nerfed}:_password`, env));
+	if (token || auth || username && password) return "valid";
+	if (token === false || auth === false || username === false || password === false) return "invalid";
+}
+/** Whether `.npmrc` content has usable auth for the registry. */
+function hasRegistryAuth(content, registry, env = process.env) {
+	return readRegistryAuth(content, registry, env) === "valid";
+}
+let npmrcCount = 0;
+/**
+* npm environment for one npm command: existing `.npmrc` auth, then npm trusted
+* publishing through GitHub Actions OIDC, then `NPM_TOKEN`. An OIDC token
+* authorizes one registry route, so every command exchanges its own.
+*
+* npm reads the project `.npmrc` before the user config, so a project
+* `_authToken=${NPM_TOKEN}` would win over a token in the user config. Both
+* files go into one temporary user config instead, the token last, and npm
+* runs outside the repository.
+*/
+async function createNpmEnv(environment, name, registry, directory, skipOidc = false) {
+	const { project, user } = readNpmConfigs(environment.cwd, environment.env);
+	const config = [user.trim(), project.trim()].filter(Boolean).join("\n");
+	const write = (content) => {
+		const file = path.join(directory, `${name.replace(/[@/]/g, "_")}-${++npmrcCount}.npmrc`);
+		fs.writeFileSync(file, `${content}\n`, { mode: 384 });
+		return {
+			...environment.env,
+			NPM_CONFIG_USERCONFIG: file
+		};
+	};
+	if ((readRegistryAuth(project, registry, environment.env) ?? readRegistryAuth(user, registry, environment.env)) === "valid") return {
+		env: write(config),
+		source: "npmrc"
+	};
+	const oidc = skipOidc ? void 0 : await exchangeOidcToken(environment, name, registry);
+	const token = oidc ?? environment.env.NPM_TOKEN;
+	if (!token) throw new Error(`No npm auth for ${name}. Configure npm trusted publishing with \`id-token: write\`, set NPM_TOKEN, or add auth to .npmrc for ${registry}.`);
+	return {
+		env: write(`${config}\n${nerfDart(registry)}:_authToken=${token}`.trim()),
+		source: oidc ? "oidc" : "token"
+	};
+}
+function detectIndent(content) {
+	return /^([ \t]+)"/m.exec(content)?.[1] ?? "    ";
+}
+/** A range for `version` in the style of `range`: exact, `~`, or `^`. */
+function rangeFor(range, version) {
+	if (semver.valid(range)) return version;
+	return range.trim().startsWith("~") ? `~${version}` : `^${version}`;
+}
+/**
+* Writes the release version and git head into a package manifest. Versions are
+* never committed, so ranges on packages of the same release, such as `^0.0.0`,
+* are moved to the release version when they do not accept it.
+*/
+function writeReleaseManifest(cwd, dir, version, gitHead, options = {}) {
+	const file = path.join(cwd, dir, "package.json");
+	const content = fs.readFileSync(file, "utf8").replace(/^\uFEFF/, "");
+	const manifest = JSON.parse(content);
+	manifest.version = version;
+	manifest.gitHead = gitHead;
+	for (const field of dependencyFields) {
+		const dependencies = manifest[field];
+		for (const [name, range] of Object.entries(dependencies ?? {})) {
+			if (!options.internal?.includes(name) || !semver.validRange(range)) continue;
+			if (!semver.satisfies(version, range, { includePrerelease: true })) dependencies[name] = rangeFor(range, version);
+		}
+	}
+	if (dir !== "." && !manifest.repository && options.repository) {
+		const root = options.repository;
+		manifest.repository = typeof root === "string" ? {
+			type: "git",
+			url: root,
+			directory: dir
+		} : {
+			...root,
+			directory: dir
+		};
+	}
+	fs.writeFileSync(file, `${JSON.stringify(manifest, null, detectIndent(content))}\n`);
+	return manifest;
+}
+/** Yarn 1 names the tarball with `--filename`; Yarn 2+ uses `--out`. */
+async function isYarnClassic(environment, env) {
+	const declared = /^yarn@(\d+)/.exec(String(readJson(path.join(environment.cwd, "package.json")).packageManager ?? ""));
+	if (declared) return declared[1] === "1";
+	const { stdout } = await environment.run("yarn", ["--version"], {
+		cwd: environment.cwd,
+		env
+	});
+	return stdout.trim().startsWith("1.");
+}
+async function packCommand(environment, packageManager, destination, env) {
+	switch (packageManager) {
+		case "bun": return ["bun", [
+			"pm",
+			"pack",
+			"--destination",
+			destination,
+			"--quiet"
+		]];
+		case "pnpm": return ["pnpm", [
+			"pack",
+			"--pack-destination",
+			destination
+		]];
+		case "yarn": return ["yarn", [
+			"pack",
+			await isYarnClassic(environment, env) ? "--filename" : "--out",
+			path.join(destination, "package.tgz")
+		]];
+		default: return ["npm", [
+			"pack",
+			"--pack-destination",
+			destination
+		]];
+	}
+}
+/** Reads `package/package.json` from a packed tarball. */
+function readPackedManifest(tarball) {
+	const archive = gunzipSync(fs.readFileSync(tarball));
+	let offset = 0;
+	let longName;
+	while (offset + 512 <= archive.length) {
+		const header = archive.subarray(offset, offset + 512);
+		if (header.every((byte) => byte === 0)) break;
+		const field = (start, length) => header.subarray(start, start + length).toString("utf8").replace(/\0.*$/s, "");
+		const size = parseInt(field(124, 12).trim() || "0", 8);
+		const type = field(156, 1);
+		const prefix = field(345, 155);
+		const name = longName ?? (prefix ? `${prefix}/${field(0, 100)}` : field(0, 100));
+		const body = archive.subarray(offset + 512, offset + 512 + size);
+		longName = void 0;
+		if (type === "L") longName = body.toString("utf8").replace(/\0.*$/s, "");
+		else if (type === "x") {
+			const pathRecord = /\d+ path=([^\n]+)\n/.exec(body.toString("utf8"));
+			if (pathRecord) longName = pathRecord[1];
+		} else if (name.replace(/^\.\//, "").split("/").slice(1).join("/") === "package.json") return JSON.parse(body.toString("utf8").replace(/^\uFEFF/, ""));
+		offset += 512 + Math.ceil(size / 512) * 512;
+	}
+	throw new Error(`${tarball} has no package.json.`);
+}
+/** Local protocols that only resolve inside the repository. */
+const localProtocols = /^(?:workspace|file|link|portal|catalog):/;
+function validatePackedManifest(manifest, pkg, version, gitHead, internal) {
+	if (manifest.name !== pkg.name) throw new Error(`The tarball of ${pkg.dir} is ${manifest.name}, not ${pkg.name}.`);
+	if (manifest.version !== version) throw new Error(`The tarball of ${pkg.name} has version ${manifest.version}, not ${version}.`);
+	if (manifest.gitHead !== gitHead) throw new Error(`The tarball of ${pkg.name} has gitHead ${String(manifest.gitHead)}, not ${gitHead}.`);
+	for (const field of dependencyFields) for (const [name, range] of Object.entries(manifest[field] ?? {})) {
+		if (localProtocols.test(range)) throw new Error(`The tarball of ${pkg.name} keeps \`${name}: ${range}\` in ${field}.`);
+		if (internal.includes(name) && semver.validRange(range) && !semver.satisfies(version, range, { includePrerelease: true })) throw new Error(`The tarball of ${pkg.name} has \`${name}: ${range}\` in ${field}, which does not accept the release version ${version}.`);
+	}
+}
+async function waitForVersion(environment, registry, name, version) {
+	for (let attempt = 1; attempt <= 30; attempt++) {
+		const published = (await readPackument(environment, registry, name))?.versions?.[version];
+		if (published) return published;
+		await environment.wait(1e4);
+	}
+	throw new Error(`${name}@${version} did not appear on ${registry}.`);
+}
+/** Cuts notes at a line to fit a GitHub release body, keeping the full changelog link. */
+function truncateNotes(notes, limit = releaseBodyLimit) {
+	if (notes.length <= limit) return notes;
+	const footer = /\n\n(\*\*Full Changelog\*\*: \S+)\n?$/.exec(notes)?.[1];
+	const tail = `\n\n${`…the notes are too long for a GitHub release${footer ? "; see the full changelog" : ""}.`}${footer ? `\n\n${footer}` : ""}\n`;
+	const cut = notes.slice(0, Math.max(0, limit - tail.length));
+	const end = cut.lastIndexOf("\n");
+	return `${(end > 0 ? cut.slice(0, end) : cut).trimEnd()}${tail}`;
+}
+/** Creates the GitHub release of a tag unless it exists. Needs `GITHUB_TOKEN` and the repository. */
+async function publishGitHubRelease(environment, release) {
+	const token = environment.env.GITHUB_TOKEN ?? environment.env.GH_TOKEN;
+	const repository = getRepositoryUrl(environment.cwd, environment.env)?.replace(/^https?:\/\/[^/]+\//, "");
+	if (!token || !repository) {
+		environment.log("! Skip the GitHub release: set GITHUB_TOKEN and a GitHub repository URL.");
+		return;
+	}
+	const api = `${(environment.env.GITHUB_API_URL ?? "https://api.github.com").replace(/\/+$/, "")}/repos/${repository}/releases`;
+	const headers = {
+		authorization: `Bearer ${token}`,
+		accept: "application/vnd.github+json",
+		"content-type": "application/json",
+		"x-github-api-version": "2022-11-28"
+	};
+	const existing = await environment.fetch(`${api}/tags/${encodeURIComponent(release.tag)}`, { headers });
+	if (existing.ok) {
+		environment.log(`✓ GitHub release ${release.tag} exists.`);
+		return (await existing.json()).html_url;
+	}
+	if (existing.status !== 404) throw new Error(`Could not check the GitHub release ${release.tag}: ${existing.status} ${await existing.text()}`);
+	const latest = release.latest ?? !release.prerelease;
+	const response = await environment.fetch(api, {
+		method: "POST",
+		headers,
+		body: JSON.stringify({
+			tag_name: release.tag,
+			...release.target ? { target_commitish: release.target } : {},
+			name: release.tag,
+			body: truncateNotes(release.notes),
+			prerelease: release.prerelease,
+			make_latest: latest ? "true" : "false"
+		})
+	});
+	if (!response.ok) throw new Error(`Could not create the GitHub release ${release.tag}: ${response.status} ${await response.text()}`);
+	const url = (await response.json()).html_url;
+	environment.log(`✓ Created the GitHub release ${url ?? release.tag}.`);
+	return url;
+}
+function describePlan(plan) {
+	const range = plan.from ? `${plan.from}..${plan.head.slice(0, 9)}` : `all commits up to ${plan.head.slice(0, 9)}`;
+	return [
+		`Branch: ${plan.branch}${plan.channel ? ` (npm dist-tag ${plan.channel.distTag})` : ""}`,
+		`Mode: ${plan.mode}`,
+		`Range: ${range}`,
+		...plan.commits.map((decision) => `  ${(decision.release || "none").padEnd(5)} ${decision.hash?.slice(0, 9) ?? ""} ${decision.header}`),
+		`Release: ${plan.release || "none"}${plan.version ? ` → ${plan.version}` : ""}`,
+		`Packages: ${plan.packages.map(({ name }) => name).join(", ") || "none"}`
+	].join("\n");
+}
+/** Whether a stable version is the highest stable version tagged in the repository. */
+async function isLatestStable(environment, version) {
+	return !lines(await git(environment, [
+		"tag",
+		"--list",
+		"v*"
+	])).flatMap((tag) => parseVersionTag(tag) ?? []).some((other) => !semver.prerelease(other) && semver.gt(other, version));
+}
+/** Pushes a version tag without the repository's pre-push hooks, which would run after npm already published. */
+async function pushTag(environment, tag) {
+	await git(environment, [
+		"push",
+		"--no-verify",
+		"origin",
+		`refs/tags/${tag}`
+	]);
+}
+/** Finishes a release whose tag points at HEAD: pushes the tag and creates a missing GitHub release. */
+async function resumeTaggedRelease(environment, options, plan) {
+	const channel = plan.channel;
+	if (!channel) return false;
+	const tag = lines(await git(environment, [
+		"tag",
+		"--list",
+		"v*",
+		"--points-at",
+		"HEAD"
+	])).find((candidate) => {
+		const version = parseVersionTag(candidate);
+		if (!version) return false;
+		const prerelease = semver.prerelease(version);
+		return channel.prerelease ? prerelease?.[0] === channel.prerelease : !prerelease;
+	});
+	if (!tag || options.dryRun) return false;
+	const previous = await planRelease({
+		...options,
+		ignoreTags: [tag],
+		version: parseVersionTag(tag)
+	}, environment);
+	if (!previous.notes) return false;
+	environment.log(`${tag} points at HEAD; make sure the tag is pushed and its GitHub release exists.`);
+	await pushTag(environment, tag);
+	await publishGitHubRelease(environment, {
+		tag,
+		notes: previous.notes,
+		prerelease: Boolean(channel.prerelease),
+		target: plan.head,
+		latest: !channel.prerelease && await isLatestStable(environment, previous.version)
+	});
+	return true;
+}
+/** The next version to try when one is taken: the next patch, or the next prerelease number. */
+function nextFreeVersion(version) {
+	return semver.prerelease(version) ? semver.inc(version, "prerelease") : semver.inc(version, "patch");
+}
+/**
+* Releases the checked-out commit:
+*
+* 1. plan the version from the commits since the channel's last tag;
+* 2. write the version and git head into every published package and pack it;
+* 3. publish each package, in dependency order, on the `aronrepo-staging`
+*    dist-tag, skipping versions already published from the same commit;
+* 4. wait until the registry serves every package, then move the channel's
+*    dist-tag to the new version;
+* 5. push the version tag and create the GitHub release.
+*
+* Every step checks what an interrupted run already did, so rerunning the job
+* finishes a release instead of skipping or duplicating it.
+*/
+async function runRelease(options = {}, environmentOptions = {}) {
+	const environment = createEnvironment(environmentOptions);
+	const { cwd, log } = environment;
+	const plan = await planRelease(options, environment);
+	log(describePlan(plan));
+	if (!plan.channel) {
+		log(`Branch ${plan.branch} does not release. Release branches: main, alpha, beta, rc, canary.`);
+		return {
+			status: "skipped",
+			plan
+		};
+	}
+	if (!plan.version || !plan.tag || !plan.notes) {
+		if (await resumeTaggedRelease(environment, options, plan)) return {
+			status: "resumed",
+			plan
+		};
+		log("No release.");
+		return {
+			status: "none",
+			plan
+		};
+	}
+	if (!plan.packages.length) throw new Error("No published package found. Add `\"publishConfig\": { \"access\": \"public\" }` to the packages that ship.");
+	for (const pkg of plan.packages) if (pkg.name.startsWith("@") && !pkg.manifest.publishConfig?.access) throw new Error(`${pkg.name} is scoped, and npm publishes scoped packages as restricted by default. Set \`publishConfig.access\` in ${pkg.dir}/package.json.`);
+	const dirty = await git(environment, ["status", "--porcelain"]);
+	const existingTag = await git(environment, [
+		"tag",
+		"--list",
+		plan.tag
+	]);
+	if (existingTag && await gitSucceeds(environment, [
+		"merge-base",
+		"--is-ancestor",
+		"HEAD",
+		plan.tag
+	])) {
+		log(`${plan.tag} is on a newer commit of ${plan.branch}; this commit is already released.`);
+		return {
+			status: "none",
+			plan
+		};
+	}
+	if (options.dryRun) {
+		if (dirty) log("! The working tree has changes; a release would stop here.");
+		if (existingTag) log(`! ${plan.tag} exists but is not reachable from ${plan.branch}; a release would stop here.`);
+		log(`\nDry run: would publish ${plan.tag} on ${plan.channel.distTag}.\n\n${plan.notes}`);
+		return {
+			status: "dry-run",
+			plan
+		};
+	}
+	if (dirty) throw new Error("The working tree has changes. Release from a clean checkout.");
+	if (existingTag) throw new Error(`${plan.tag} exists but is not reachable from ${plan.branch}.`);
+	const npmrc = (() => {
+		const { project, user } = readNpmConfigs(cwd, environment.env);
+		return `${user}\n${project}`;
+	})();
+	const registryOf = (pkg) => getRegistry(pkg.manifest, environment.env, npmrc);
+	let version = plan.version;
+	for (let attempt = 0;; attempt++) {
+		const taken = [];
+		for (const pkg of plan.packages) {
+			const published = (await readPackument(environment, registryOf(pkg), pkg.name))?.versions?.[version];
+			if (!published || published.gitHead === plan.head) continue;
+			if (!published.gitHead) throw new Error(`${pkg.name}@${version} is already published without a gitHead, so aronrepo cannot tell which commit it came from. Tag that commit ${toVersionTag(version)}, or publish a newer version.`);
+			taken.push(`${pkg.name}@${version} (${published.gitHead.slice(0, 9)})`);
+		}
+		if (!taken.length) break;
+		if (attempt >= 20 || await git(environment, [
+			"tag",
+			"--list",
+			toVersionTag(nextFreeVersion(version))
+		])) throw new Error(`${taken.join(", ")} is already published from another commit, not ${plan.head}.`);
+		const next = nextFreeVersion(version);
+		log(`! ${taken.join(", ")} is already published from another commit without a ${toVersionTag(version)} tag; releasing ${next} instead.`);
+		version = next;
+	}
+	if (version !== plan.version) {
+		plan.version = version;
+		plan.tag = toVersionTag(version);
+		plan.notes = renderPlanNotes(environment, plan, version, options.date);
+	}
+	const { tag, notes, channel } = {
+		tag: plan.tag,
+		notes: plan.notes,
+		channel: plan.channel
+	};
+	for (const pkg of plan.packages) {
+		const packument = await readPackument(environment, registryOf(pkg), pkg.name);
+		const current = packument?.["dist-tags"]?.[channel.distTag];
+		if (current && semver.valid(current) && semver.gt(current, version)) throw new Error(`${pkg.name} has ${current} on ${channel.distTag}, newer than ${version}. Tag the commit of ${current} as ${toVersionTag(current)} so releases continue from it.`);
+		if (!packument && channel.prerelease) log(`! ${pkg.name} is new; npm also points \`latest\` at its first version, ${version}.`);
+	}
+	const directory = fs.mkdtempSync(path.join(os.tmpdir(), "aronrepo-release-"));
+	const manifests = new Map(plan.packages.map(({ dir }) => {
+		const file = path.join(cwd, dir, "package.json");
+		return [file, fs.readFileSync(file, "utf8")];
+	}));
+	let restored = false;
+	const restore = () => {
+		if (restored) return;
+		restored = true;
+		fs.rmSync(directory, {
+			recursive: true,
+			force: true
+		});
+		for (const [file, content] of manifests) fs.writeFileSync(file, content);
+	};
+	const onSignal = (signal) => {
+		restore();
+		process.kill(process.pid, signal);
+	};
+	process.once("SIGINT", onSignal);
+	process.once("SIGTERM", onSignal);
+	const runNpm = async (pkg, args) => {
+		const registry = registryOf(pkg);
+		const command = [
+			...args,
+			"--registry",
+			registry
+		];
+		const auth = await createNpmEnv(environment, pkg.name, registry, directory);
+		try {
+			return await environment.run("npm", command, {
+				cwd: directory,
+				env: auth.env
+			});
+		} catch (error) {
+			if (auth.source !== "oidc" || !environment.env.NPM_TOKEN) throw error;
+			log(`! \`npm ${args[0]}\` failed with the trusted publishing token; retrying with NPM_TOKEN.`);
+			const fallback = await createNpmEnv(environment, pkg.name, registry, directory, true);
+			return await environment.run("npm", command, {
+				cwd: directory,
+				env: fallback.env
+			});
+		}
+	};
+	try {
+		const packageManager = detectPackageManager(cwd);
+		const internal = plan.packages.map(({ name }) => name);
+		const repository = (() => {
+			const root = path.join(cwd, "package.json");
+			return fs.existsSync(root) ? readJson(root).repository : void 0;
+		})();
+		for (const pkg of plan.packages) pkg.manifest = writeReleaseManifest(cwd, pkg.dir, version, plan.head, {
+			internal,
+			repository
+		});
+		const packEnv = withoutSecrets(environment.env);
+		const tarballs = /* @__PURE__ */ new Map();
+		for (const [index, pkg] of plan.packages.entries()) {
+			const destination = path.join(directory, String(index));
+			fs.mkdirSync(destination);
+			const [command, args] = await packCommand(environment, packageManager, destination, packEnv);
+			await environment.run(command, args, {
+				cwd: path.join(cwd, pkg.dir),
+				env: packEnv
+			});
+			const tarball = fs.readdirSync(destination).find((file) => file.endsWith(".tgz"));
+			if (!tarball) throw new Error(`Packing ${pkg.name} produced no tarball.`);
+			const file = path.join(destination, tarball);
+			validatePackedManifest(readPackedManifest(file), pkg, version, plan.head, internal);
+			tarballs.set(pkg.name, file);
+			log(`✓ Packed ${pkg.name}@${version}`);
+		}
+		for (const pkg of plan.packages) {
+			const registry = registryOf(pkg);
+			const isPublished = async () => (await readPackument(environment, registry, pkg.name))?.versions?.[version]?.gitHead === plan.head;
+			if (await isPublished()) {
+				log(`✓ ${pkg.name}@${version} is already published from this commit.`);
+				continue;
+			}
+			const args = [
+				"publish",
+				tarballs.get(pkg.name),
+				"--tag",
+				stagingDistTag
+			];
+			if (pkg.manifest.publishConfig?.access) args.push("--access", String(pkg.manifest.publishConfig.access));
+			if (pkg.manifest.publishConfig?.provenance) args.push("--provenance");
+			try {
+				await runNpm(pkg, args);
+			} catch (error) {
+				await environment.wait(5e3);
+				if (!await isPublished()) throw error;
+				log(`✓ ${pkg.name}@${version} was already published from this commit.`);
+				continue;
+			}
+			log(`✓ Published ${pkg.name}@${version} on ${stagingDistTag}`);
+		}
+		for (const pkg of plan.packages) {
+			const registry = registryOf(pkg);
+			const published = await waitForVersion(environment, registry, pkg.name, version);
+			if (pkg.manifest.publishConfig?.provenance && !published.dist?.attestations) log(`! ${pkg.name}@${version} has no provenance attestation on ${registry}.`);
+		}
+		for (const pkg of plan.packages) {
+			const tags = (await readPackument(environment, registryOf(pkg), pkg.name))?.["dist-tags"] ?? {};
+			if (tags[channel.distTag] !== version) await runNpm(pkg, [
+				"dist-tag",
+				"add",
+				`${pkg.name}@${version}`,
+				channel.distTag
+			]);
+			if (tags["aronrepo-staging"]) await runNpm(pkg, [
+				"dist-tag",
+				"rm",
+				pkg.name,
+				stagingDistTag
+			]).catch((error) => log(`! Could not remove the ${stagingDistTag} dist-tag of ${pkg.name}: ${error.message}`));
+			log(`✓ ${pkg.name}@${version} is on ${channel.distTag}`);
+		}
+	} finally {
+		process.removeListener("SIGINT", onSignal);
+		process.removeListener("SIGTERM", onSignal);
+		restore();
+	}
+	await git(environment, [
+		"-c",
+		"tag.gpgSign=false",
+		"tag",
+		tag,
+		plan.head
+	]);
+	await pushTag(environment, tag);
+	log(`✓ Pushed ${tag}`);
+	await publishGitHubRelease(environment, {
+		tag,
+		notes,
+		prerelease: Boolean(channel.prerelease),
+		target: plan.head,
+		latest: !channel.prerelease && await isLatestStable(environment, version)
+	});
+	return {
+		status: "released",
+		plan
+	};
+}
+// src/commands.ts
+function resolveCwd(options) {
+	return options.cwd ? path.resolve(options.cwd) : getRepositoryRoot(process.cwd());
+}
+function usage(message) {
+	return {
+		code: 2,
+		output: message
+	};
+}
+const ignoredMessagePatterns = [
+	/^Merge pull request #\d+ from \S+/,
+	/^Merge (?:branch|branches|remote-tracking branch|tag|commit) '[^']+'/,
+	/^Merge [0-9a-f]{7,40}(?: into \S+)?$/,
+	/^Merged in \S+ \(pull request #\d+\)/,
+	/^Automatic merge from /,
+	/^Auto-merged \S+ into \S+/,
+	/^(?:fixup|squash|amend)! /,
+	/^Initial commit$/
+];
+function isIgnoredMessage(message) {
+	const header = message.trim().split("\n")[0] ?? "";
+	return ignoredMessagePatterns.some((pattern) => pattern.test(header));
+}
+function escapeRegExp(text) {
+	return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* A commit message file without git's comments and, with `git commit -v`,
+* without the diff below the scissors line. `commentChar` is git's
+* `core.commentChar`; `auto` falls back to `#`.
+*/
+function readEditMessage(file, commentChar = "#") {
+	const comment = commentChar && commentChar !== "auto" ? commentChar : "#";
+	return fs.readFileSync(file, "utf8").replace(/^\uFEFF/, "").replace(/\r\n/g, "\n").split(new RegExp(`^${escapeRegExp(comment)} -+ >8 -+$`, "m"))[0].split("\n").filter((line) => !line.startsWith(comment)).join("\n").trim();
+}
+async function project(cwd, options) {
+	return loadProjectPolicy(cwd, options.mode ? { mode: options.mode } : {});
+}
+function isError(violation) {
+	return (violation.severity ?? "error") === "error";
+}
+function formatViolation(violation) {
+	return `  ${isError(violation) ? "✗" : "!"} ${violation.message}${violation.suggestion ? `\n    Suggested header: ${violation.suggestion}` : ""}`;
+}
+function formatDecision(decision) {
+	return `${decision.hash ? `${decision.hash.slice(0, 9)} ` : ""}${(decision.release || "none").padEnd(5)}  ${decision.header}\n${decision.reasons.map((reason) => `       ${reason}`).join("\n")}`;
+}
+/** Repository-relative POSIX paths, as git prints them. */
+function normalizeFiles(files, cwd) {
+	return files.map((file) => {
+		return (path.isAbsolute(file) ? path.relative(cwd, file) : file).replace(/\\/g, "/").replace(/^(?:\.\/)+/, "");
+	});
+}
+async function check(options) {
+	const modes = [
+		options.edit !== void 0 && "--edit",
+		options.message !== void 0 && "--message",
+		options.title !== void 0 && "--title",
+		options.from !== void 0 && "--from"
+	].filter(Boolean);
+	if (!modes.length) return usage("Pass --edit <file>, --message <text>, --title <text>, or --from <ref>.");
+	if (modes.length > 1) return usage(`Pass only one of ${modes.join(", ")}.`);
+	if (options.to !== void 0 && options.from === void 0) return usage("--to needs --from.");
+	if ((options.base !== void 0 || options.head !== void 0) && options.title === void 0) return usage("--base and --head only apply to --title.");
+	if (options.base === void 0 !== (options.head === void 0)) return usage("Pass --base and --head together.");
+	if (options.files && options.from !== void 0) return usage("--files does not apply to --from; each commit has its own files.");
+	const cwd = resolveCwd(options);
+	const { policy, isReleasePath } = await project(cwd, options);
+	const pathOptions = isReleasePath ? { isReleasePath } : {};
+	const files = options.files && normalizeFiles(options.files, cwd);
+	const notes = [];
+	let entries;
+	if (options.title !== void 0) {
+		const diff = files ?? (options.base && options.head ? getDiffFiles(cwd, options.base, options.head) : void 0);
+		if (!diff && isReleasePath) notes.push("! Release paths are not checked; pass --base and --head, or --files.");
+		entries = [{
+			message: options.title,
+			...diff ? { files: diff } : {},
+			label: "PR title",
+			ignorable: false
+		}];
+	} else if (options.edit !== void 0 || options.message !== void 0) {
+		let message = options.message ?? "";
+		if (options.edit !== void 0) {
+			message = readEditMessage(path.resolve(cwd, options.edit), getGitConfig(cwd, "core.commentChar"));
+			if (!message) return {
+				code: 0,
+				output: "The commit message is empty; git aborts the commit."
+			};
+		}
+		let changed = files ?? getStagedFiles(cwd);
+		if (!changed.length && !files && options.edit !== void 0) try {
+			changed = getCommitFiles(cwd, "HEAD");
+		} catch {
+			changed = [];
+		}
+		entries = [{
+			message,
+			files: changed,
+			label: "Commit message",
+			ignorable: true
+		}];
+	} else entries = getRangeCommits(cwd, options.from, options.to ?? "HEAD").map((commit) => ({
+		...commit,
+		label: commit.hash.slice(0, 9),
+		ignorable: true
+	}));
+	const results = entries.filter(({ message, ignorable }) => !ignorable || !isIgnoredMessage(message)).map((entry) => ({
+		entry,
+		decision: resolveCommitRelease(parseCommit(entry.message, entry.hash), policy, {
+			...pathOptions,
+			...entry.files ? { files: entry.files } : {}
+		})
+	}));
+	const failures = results.filter(({ decision }) => decision.violations.some(isError));
+	if (options.json) return {
+		code: failures.length ? 1 : 0,
+		output: JSON.stringify({
+			mode: policy.mode,
+			results: results.map(({ entry, decision }) => ({
+				label: entry.label,
+				...decision
+			})),
+			...notes.length ? { notes } : {}
+		}, null, 2)
+	};
+	if (!failures.length) return {
+		code: 0,
+		output: [
+			...results.map(({ entry, decision }) => [`✓ ${entry.label}: ${decision.release || "none"} ← ${decision.header}`, ...decision.violations.map(formatViolation)].join("\n")),
+			...notes,
+			`${results.length} ${results.length === 1 ? "header follows" : "headers follow"} the Aronrepo ${policy.mode} release policy.`
+		].join("\n")
+	};
+	return {
+		code: 1,
+		output: [
+			...failures.map(({ entry, decision }) => `${entry.label}: ${decision.header}\n${decision.violations.map(formatViolation).join("\n")}`),
+			...notes,
+			"",
+			"Run `aronrepo policy` to see which types release and which paths ship."
+		].join("\n")
+	};
+}
+async function explain(options) {
+	const cwd = resolveCwd(options);
+	const { policy, isReleasePath, releasePaths } = await project(cwd, options);
+	let plan;
+	let from;
+	let to = options.to ?? "HEAD";
+	if (options.from === void 0 && options.to === void 0) {
+		plan = await planRelease({
+			fallbackToMain: true,
+			...options.mode ? { mode: options.mode } : {}
+		}, { cwd });
+		from = plan.from;
+		to = "HEAD";
+	} else {
+		const channel = getReleaseChannel(getCurrentBranch(cwd)) ?? getReleaseChannel("main");
+		const reachable = getVersionTags(cwd, `${to}^`);
+		from = options.from ?? getBaseTag(channel, reachable);
+		const decision = resolveRelease(getRangeCommits(cwd, from, to), policy, isReleasePath ? { isReleasePath } : {});
+		const version = decision.release && options.from === void 0 ? getNextVersion(channel, decision.release, {
+			reachable,
+			all: getVersionTags(cwd)
+		}) : void 0;
+		plan = {
+			...decision,
+			channel,
+			...version ? {
+				version,
+				tag: toVersionTag(version)
+			} : {}
+		};
+	}
+	if (options.json) return {
+		code: 0,
+		output: JSON.stringify({
+			mode: policy.mode,
+			...plan.branch ? { branch: plan.branch } : {},
+			...plan.channel ? { channel: plan.channel } : {},
+			from: from ?? null,
+			to,
+			releasePaths: releasePaths ?? null,
+			release: plan.release,
+			version: plan.version ?? null,
+			tag: plan.tag ?? null,
+			commits: plan.commits
+		}, null, 2)
+	};
+	return {
+		code: 0,
+		output: [
+			`Range: ${from ? `${from}..${to}` : `all commits up to ${to}`}`,
+			`Mode: ${policy.mode}`,
+			...plan.channel ? [`Channel: ${plan.channel.branch} (npm dist-tag ${plan.channel.distTag})`] : [],
+			`Release paths: ${releasePaths?.include ? releasePaths.include.join(", ") : "every path"}`,
+			"",
+			...plan.commits.length ? plan.commits.map(formatDecision) : ["No commits."],
+			"",
+			`Next release: ${plan.release || "none"}${plan.version ? ` (${plan.version})` : ""}`
+		].join("\n")
+	};
+}
+async function release(options) {
+	const cwd = resolveCwd(options);
+	const result = await runRelease({
+		...options.mode ? { mode: options.mode } : {},
+		...options.branch ? { branch: options.branch } : {},
+		...options.dryRun ? { dryRun: true } : {}
+	}, {
+		cwd,
+		log: options.json ? () => {} : options.log ?? ((message) => console.log(message))
+	});
+	if (!options.json) return {
+		code: 0,
+		output: ""
+	};
+	const { packages, ...plan } = result.plan;
+	return {
+		code: 0,
+		output: JSON.stringify({
+			status: result.status,
+			...plan,
+			packages: packages.map(({ dir, name }) => ({
+				dir,
+				name
+			}))
+		}, null, 2)
+	};
+}
+async function policy(options) {
+	if (options.json && options.markdown) return usage("Pass --json or --markdown, not both.");
+	const resolved = await project(resolveCwd(options), options);
+	if (options.markdown) return {
+		code: 0,
+		output: renderAgentsBlock(resolved.policy, {
+			cli: resolved.cli,
+			...resolved.releasePaths ? { releasePaths: resolved.releasePaths } : {}
+		})
+	};
+	const table = getReleaseTable(resolved.policy);
+	const data = {
+		mode: resolved.policy.mode,
+		configFile: resolved.configFile ? path.relative(resolved.cwd, resolved.configFile) : null,
+		releasePaths: resolved.releasePaths ?? null,
+		releaseTable: Object.fromEntries(Object.entries(table).map(([level, rules]) => [level, rules.map((rule) => rule.replace(/`/g, ""))])),
+		types: commits.map(({ type, scope, description, group }) => ({
+			type,
+			...scope ? { scope } : {},
+			release: getReleaseType(type, scope, resolved.policy) ?? false,
+			description,
+			...group ? { group } : {}
+		})),
+		legacyTypes: legacyCommits,
+		agent: getAgentCommitPolicy(resolved.policy, { cli: resolved.cli })
+	};
+	if (options.json) return {
+		code: 0,
+		output: JSON.stringify(data, null, 2)
+	};
+	return {
+		code: 0,
+		output: [
+			`Mode: ${data.mode}${data.configFile ? ` (${data.configFile})` : " (default; no aronrepo.config.js)"}`,
+			`Release paths: ${data.releasePaths?.include ? data.releasePaths.include.join(", ") : "every path"}`,
+			...data.releasePaths?.include ? [`Excluded: ${(data.releasePaths.exclude ?? defaultReleasePathExcludes).join(", ")}`] : [],
+			"",
+			`Major: ${table.major.join(", ") || "-"}`,
+			`Minor: ${table.minor.join(", ") || "-"}`,
+			`Patch: ${table.patch.join(", ") || "-"}`,
+			`None:  ${table.none.join(", ") || "-"}`,
+			"",
+			...data.agent.ownerDecisions.map((rule) => `- ${rule}`)
+		].join("\n")
+	};
+}
+/** Where the generated block is, `undefined` when there is none; throws when its markers are broken. */
+function findAgentsBlock(content) {
+	const start = content.indexOf(agentsBlockStart);
+	const firstEnd = content.indexOf(agentsBlockEnd);
+	if (start === -1 && firstEnd === -1) return void 0;
+	const end = start === -1 ? -1 : content.indexOf(agentsBlockEnd, start);
+	if (start === -1 || end === -1 || firstEnd < start) throw new Error(`The Aronrepo commit policy markers are out of order. Keep one ${agentsBlockStart} followed by one ${agentsBlockEnd}.`);
+	if (content.indexOf("<!-- aronrepo:commit-policy:start -->", start + 1) !== -1 || content.indexOf("<!-- aronrepo:commit-policy:end -->", end + 1) !== -1) throw new Error("The Aronrepo commit policy block appears more than once. Keep one block.");
+	return {
+		start,
+		end: end + agentsBlockEnd.length
+	};
+}
+function replaceAgentsBlock(content, block) {
+	const found = findAgentsBlock(content);
+	if (found) return content.slice(0, found.start) + block + content.slice(found.end);
+	return `${content.trimEnd()}${content.trim() ? "\n\n" : ""}${block}\n`;
+}
+function readAgentsBlock(content) {
+	try {
+		const found = findAgentsBlock(content);
+		return found ? content.slice(found.start, found.end) : void 0;
+	} catch {
+		return;
+	}
+}
+async function agents(options) {
+	const cwd = resolveCwd(options);
+	const resolved = await project(cwd, options);
+	const file = path.resolve(cwd, options.file ?? "AGENTS.md");
+	const relative = path.relative(cwd, file);
+	const block = renderAgentsBlock(resolved.policy, {
+		cli: resolved.cli,
+		...resolved.releasePaths ? { releasePaths: resolved.releasePaths } : {}
+	});
+	const raw = fs.existsSync(file) ? fs.readFileSync(file, "utf8") : "";
+	const eol = raw.includes("\r\n") ? "\r\n" : "\n";
+	const content = raw.replace(/\r\n/g, "\n");
+	const result = (code, status, message) => ({
+		code,
+		output: options.json ? JSON.stringify({
+			file: relative,
+			status
+		}, null, 2) : message
+	});
+	if (options.write) {
+		const next = replaceAgentsBlock(content || "# Agent Guide\n", block);
+		if (next === content) return result(0, "current", `✓ ${relative} is up to date.`);
+		fs.mkdirSync(path.dirname(file), { recursive: true });
+		fs.writeFileSync(file, eol === "\n" ? next : next.replace(/\n/g, eol));
+		return result(0, "written", `✓ Wrote the Aronrepo commit policy block to ${relative}.`);
+	}
+	const current = readAgentsBlock(content);
+	if (current === block) return result(0, "current", `✓ ${relative} has the current Aronrepo commit policy block.`);
+	return result(1, current ? "outdated" : "missing", `✗ ${relative} ${current ? "has an outdated" : "is missing the"} Aronrepo commit policy block. Run \`${resolved.cli} agents --write\`.`);
+}
+function findFile(cwd, names) {
+	return names.map((name) => path.join(cwd, name)).find((file) => fs.existsSync(file));
+}
+function readText(file) {
+	return file ? fs.readFileSync(file, "utf8") : "";
+}
+const legacyDependencies = [
+	"semantic-release",
+	"@commitlint/cli",
+	"@aronrepo/commitlint-config",
+	"@aronrepo/conventional-changelog-config",
+	"@aronrepo/semantic-release-config",
+	"@aronrepo/semantic-release-pnpm"
+];
+const legacyConfigFiles = [
+	"release.config.js",
+	"release.config.mjs",
+	"release.config.cjs",
+	".releaserc",
+	".releaserc.js",
+	".releaserc.mjs",
+	".releaserc.json",
+	"commitlint.config.js",
+	"commitlint.config.mjs",
+	"commitlint.config.ts",
+	".commitlintrc",
+	".commitlintrc.js",
+	".commitlintrc.mjs",
+	".commitlintrc.json"
+];
+function installCommand(packageManager) {
+	return {
+		bun: "bun add -d aronrepo",
+		pnpm: "pnpm add -D aronrepo",
+		yarn: "yarn add -D aronrepo",
+		npm: "npm install -D aronrepo"
+	}[packageManager];
+}
+async function doctor(options) {
+	const cwd = resolveCwd(options);
+	const checks = [];
+	let resolved;
+	const packageManager = (() => {
+		try {
+			return detectPackageManager(cwd);
+		} catch {
+			return "npm";
+		}
+	})();
+	const cli = getCliCommand(packageManager);
+	try {
+		resolved = await project(cwd, options);
+		checks.push(resolved.configFile ? {
+			status: "pass",
+			message: `Release mode ${resolved.policy.mode} from ${path.relative(cwd, resolved.configFile)}.`
+		} : {
+			status: "warn",
+			message: `No aronrepo.config.js; using the default ${resolved.policy.mode} mode.`,
+			fix: "Ask the repository owner whether releases are explicit (owner-controlled) or auto, then create aronrepo.config.js with `release.mode`."
+		});
+	} catch (error) {
+		checks.push({
+			status: "fail",
+			message: `The Aronrepo config failed to load: ${error.message}`
+		});
+	}
+	if (resolved) checks.push(resolved.releasePaths?.include ? {
+		status: "pass",
+		message: `Release paths: ${resolved.releasePaths.include.join(", ")}.`
+	} : {
+		status: "warn",
+		message: "No published package found; every path can release a version.",
+		fix: "Set `release.paths.include` in aronrepo.config.js, or add `publishConfig.access: \"public\"` to published packages."
+	});
+	let pkg = {};
+	try {
+		const file = findFile(cwd, ["package.json"]);
+		if (file) pkg = readJsonFile(file);
+	} catch (error) {
+		checks.push({
+			status: "fail",
+			message: error.message
+		});
+	}
+	const dependencies = {
+		...pkg.dependencies,
+		...pkg.devDependencies
+	};
+	checks.push(dependencies.aronrepo ? {
+		status: "pass",
+		message: "aronrepo is installed."
+	} : {
+		status: "fail",
+		message: "aronrepo is not a dependency.",
+		fix: `Install it as a dev dependency: \`${installCommand(packageManager)}\`.`
+	});
+	const leftovers = [...legacyDependencies.filter((name) => dependencies[name]), ...legacyConfigFiles.filter((name) => fs.existsSync(path.join(cwd, name)))];
+	checks.push(leftovers.length ? {
+		status: "warn",
+		message: `Leftovers from semantic-release or commitlint: ${leftovers.join(", ")}.`,
+		fix: "Remove them; `aronrepo check` lints commits and `aronrepo release` publishes releases."
+	} : {
+		status: "pass",
+		message: "No semantic-release or commitlint leftovers."
+	});
+	try {
+		const releasePackages = getReleasePackages(cwd);
+		const withoutRepository = releasePackages.filter(({ manifest }) => manifest.publishConfig?.provenance && !manifest.repository && !pkg.repository);
+		checks.push(!releasePackages.length ? {
+			status: "warn",
+			message: "`aronrepo release` finds no published package.",
+			fix: "Add `\"publishConfig\": { \"access\": \"public\" }` to each package that ships."
+		} : withoutRepository.length ? {
+			status: "warn",
+			message: `npm provenance needs a \`repository\` field: ${withoutRepository.map(({ name }) => name).join(", ")}.`,
+			fix: "Add `repository` to the root package.json."
+		} : {
+			status: "pass",
+			message: `\`aronrepo release\` publishes ${releasePackages.map(({ name }) => name).join(", ")}.`
+		});
+	} catch (error) {
+		checks.push({
+			status: "fail",
+			message: error.message
+		});
+	}
+	const hook = readText(findFile(cwd, [".husky/commit-msg"])).split(/\r?\n/).filter((line) => !line.trim().startsWith("#")).join("\n");
+	const hooksPath = getGitConfig(cwd, "core.hooksPath");
+	if (!hook.includes("aronrepo check")) checks.push({
+		status: "warn",
+		message: "No commit-msg hook runs `aronrepo check`.",
+		fix: `Add .husky/commit-msg with \`${cli} check --edit "$1"\`.`
+	});
+	else if (!hooksPath?.replace(/\\/g, "/").startsWith(".husky")) checks.push({
+		status: "warn",
+		message: ".husky/commit-msg is not installed; git does not run it.",
+		fix: "Run `husky` once, for example from the `prepare` script, to set `core.hooksPath`."
+	});
+	else checks.push({
+		status: "pass",
+		message: ".husky/commit-msg runs aronrepo check."
+	});
+	if (resolved) {
+		const agentsResult = await agents({
+			...options,
+			cwd,
+			json: false
+		});
+		checks.push(agentsResult.code === 0 ? {
+			status: "pass",
+			message: "AGENTS.md has the current commit policy block."
+		} : {
+			status: "fail",
+			message: agentsResult.output.replace(/^✗ /, "").replace(/ Run `.*`\.$/, ""),
+			fix: `${resolved.cli} agents --write`
+		});
+	}
+	const failed = checks.some(({ status }) => status === "fail");
+	if (options.json) return {
+		code: failed ? 1 : 0,
+		output: JSON.stringify({
+			ok: !failed,
+			checks
+		}, null, 2)
+	};
+	const icon = {
+		pass: "✓",
+		warn: "!",
+		fail: "✗"
+	};
+	return {
+		code: failed ? 1 : 0,
+		output: [
+			...checks.map(({ status, message, fix }) => `${icon[status]} ${message}${fix ? `\n    Fix: ${fix}` : ""}`),
+			"",
+			failed ? "Aronrepo setup is incomplete." : "Aronrepo setup is complete."
+		].join("\n")
+	};
+}
+export { findConfigFile as A, getStagedFiles as B, runRelease as C, configFileNames as D, writeReleaseManifest as E, getGitConfig as F, queryReleaseDirs as G, loadConfig as H, getLatestTag as I, readWorkspacePackage as J, queryWorkspaceDirs as K, getProjectCliCommand as L, getCommitFiles as M, getCurrentBranch as N, detectPackageManager as O, getDiffFiles as P, getRangeCommits as R, runCommand as S, truncateNotes as T, loadProjectPolicy as U, getVersionTags as V, queryPublicWorkspaceDirs as W, resolveReleasePaths as X, readWorkspacePatterns as Y, planRelease as _, isIgnoredMessage as a, readPackedManifest as b, readEditMessage as c, exchangeOidcToken as d, getRegistry as f, officialRegistry as g, hasRegistryAuth as h, explain as i, getCliCommand as j, explainRange as k, release as l, getRepositoryUrl as m, check as n, policy as o, getReleasePackages as p, readJsonFile as q, doctor as r, readAgentsBlock as s, agents as t, replaceAgentsBlock as u, publishGitHubRelease as v, stagingDistTag as w, releaseBodyLimit as x, quoteWindowsArg as y, getRepositoryRoot as z };
+
+//# sourceMappingURL=commands-ClWK0lQ9.js.map