audrey 1.0.1 → 1.0.2

package/scripts/finalize-release.mjs

@@ -67,7 +67,8 @@ function safeRepoRelativePath(value, label) {
 function normalizeArgs(args) {
   args.version = safeVersion(args.version);
   args.artifactDir = safeRepoRelativePath(args.artifactDir, '--artifact-dir');
-  if (args.commitMessage !== null) args.commitMessage = safeString(args.commitMessage, '--commit-message');
+  if (args.commitMessage !== null)
+    args.commitMessage = safeString(args.commitMessage, '--commit-message');
   if (args.npmOtp !== null) args.npmOtp = safeString(args.npmOtp, '--npm-otp');
   return args;
 }
@@ -109,7 +110,8 @@ function parseArgs(argv = process.argv.slice(2)) {
 
   for (let i = 0; i < argv.length; i++) {
     const token = argv[i];
-    if ((token === '--version' || token === '--target-version') && argv[i + 1]) args.version = argv[++i];
+    if ((token === '--version' || token === '--target-version') && argv[i + 1])
+      args.version = argv[++i];
     else if (token === '--artifact-dir' && argv[i + 1]) args.artifactDir = argv[++i];
     else if (token === '--commit-message' && argv[i + 1]) args.commitMessage = argv[++i];
     else if (token === '--npm-otp' && argv[i + 1]) args.npmOtp = argv[++i];
@@ -162,7 +164,9 @@ function commandFor(command, args) {
   if (!RELEASE_COMMANDS.has(command)) {
     throw new Error(`Unsupported release command: ${command}`);
   }
-  const safeArgs = args.map((arg, index) => safeString(String(arg), `${command} argument ${index + 1}`));
+  const safeArgs = args.map((arg, index) =>
+    safeString(String(arg), `${command} argument ${index + 1}`),
+  );
   if (process.platform === 'win32' && command === 'npm') {
     return { command: 'cmd.exe', args: ['/d', '/c', 'npm', ...safeArgs] };
   }
@@ -218,7 +222,9 @@ function listArtifacts(artifactDir, version) {
   }
 
   return files.map(path => ({
-    path: path.startsWith(ROOT) ? path.slice(ROOT.length + 1).replaceAll('\\', '/') : path.replaceAll('\\', '/'),
+    path: path.startsWith(ROOT)
+      ? path.slice(ROOT.length + 1).replaceAll('\\', '/')
+      : path.replaceAll('\\', '/'),
     sha256: sha256(path),
     bytes: readFileSync(path).byteLength,
   }));
@@ -280,15 +286,23 @@ function buildPlan(args) {
   if (args.tag) commands.push(`git tag -a ${tagName} -m "Audrey ${args.version}"`);
   if (args.push) commands.push(`git push origin HEAD:master --follow-tags`);
   if (args.pack) commands.push(`npm pack --pack-destination ${args.artifactDir}`);
-  if (args.sourceBundle) commands.push(`git bundle create ${args.artifactDir}/audrey-${args.version}.git.bundle refs/heads/master refs/tags/v${args.version}`);
+  if (args.sourceBundle)
+    commands.push(
+      `git bundle create ${args.artifactDir}/audrey-${args.version}.git.bundle refs/heads/master refs/tags/v${args.version}`,
+    );
   if (args.publishNpm) {
     const otp = args.npmOtp ? ' --otp <provided>' : '';
-    commands.push(`npm publish ${args.artifactDir}/audrey-${args.version}.tgz --access public --registry ${NPM_REGISTRY}${otp}`);
+    commands.push(
+      `npm publish ${args.artifactDir}/audrey-${args.version}.tgz --access public --registry ${NPM_REGISTRY}${otp}`,
+    );
   }
-  if (args.publishPypi) commands.push(`python -m twine upload python/dist/audrey_memory-${args.version}*`);
+  if (args.publishPypi)
+    commands.push(`python -m twine upload python/dist/audrey_memory-${args.version}*`);
 
   if (actions.length === 0) {
-    blockers.push('Select at least one action such as --pack, --source-bundle, --commit, --tag, --push, --publish-npm, or --publish-pypi');
+    blockers.push(
+      'Select at least one action such as --pack, --source-bundle, --commit, --tag, --push, --publish-npm, or --publish-pypi',
+    );
   }
   if (args.publishPypi && !pypiCredentialEnv()) {
     blockers.push('Set TWINE_PASSWORD, PYPI_API_TOKEN, or UV_PUBLISH_TOKEN before --publish-pypi');
@@ -312,12 +326,18 @@ function buildPlan(args) {
 }
 
 function runReadiness(plan) {
-  const readiness = run('node', ['scripts/verify-release-readiness.mjs', '--allow-pending', '--json'], { timeout: 180_000 });
+  const readiness = run(
+    'node',
+    ['scripts/verify-release-readiness.mjs', '--allow-pending', '--json'],
+    { timeout: 180_000 },
+  );
   plan.results.push(readiness);
   assertOk(readiness);
   const report = JSON.parse(readiness.stdout);
   if (!report.ok) {
-    throw new Error(`release readiness failed: ${report.failures?.join('; ') || 'unknown failure'}`);
+    throw new Error(
+      `release readiness failed: ${report.failures?.join('; ') || 'unknown failure'}`,
+    );
   }
   plan.readiness = {
     ok: report.ok,
@@ -367,7 +387,20 @@ function createSourceBundle(args, plan) {
   }
 
   const tree = assertOk(run('git', ['write-tree'], { env })).stdout;
-  const commit = assertOk(run('git', ['commit-tree', tree, '-p', 'HEAD', '-m', args.commitMessage ?? `Release Audrey ${args.version}`], { env })).stdout;
+  const commit = assertOk(
+    run(
+      'git',
+      [
+        'commit-tree',
+        tree,
+        '-p',
+        'HEAD',
+        '-m',
+        args.commitMessage ?? `Release Audrey ${args.version}`,
+      ],
+      { env },
+    ),
+  ).stdout;
   const tagContent = [
     `object ${commit}`,
     'type commit',
@@ -384,17 +417,33 @@ function createSourceBundle(args, plan) {
   mkdirSync(join(gitDir, 'refs', 'heads'), { recursive: true });
   mkdirSync(join(gitDir, 'refs', 'tags'), { recursive: true });
   writeFileSync(join(gitDir, 'HEAD'), 'ref: refs/heads/master\n', 'utf-8');
-  writeFileSync(join(gitDir, 'config'), '[core]\n\trepositoryformatversion = 0\n\tfilemode = false\n\tbare = true\n', 'utf-8');
+  writeFileSync(
+    join(gitDir, 'config'),
+    '[core]\n\trepositoryformatversion = 0\n\tfilemode = false\n\tbare = true\n',
+    'utf-8',
+  );
   writeFileSync(join(gitDir, 'refs', 'heads', 'master'), `${commit}\n`, 'utf-8');
   writeFileSync(join(gitDir, 'refs', 'tags', `v${args.version}`), `${tag}\n`, 'utf-8');
 
-  const bundle = run('git', ['--git-dir', gitDir, 'bundle', 'create', bundlePath, 'refs/heads/master', `refs/tags/v${args.version}`], {
-    env: {
-      GIT_OBJECT_DIRECTORY: objectDir,
-      GIT_ALTERNATE_OBJECT_DIRECTORIES: fromRoot('.git/objects'),
+  const bundle = run(
+    'git',
+    [
+      '--git-dir',
+      gitDir,
+      'bundle',
+      'create',
+      bundlePath,
+      'refs/heads/master',
+      `refs/tags/v${args.version}`,
+    ],
+    {
+      env: {
+        GIT_OBJECT_DIRECTORY: objectDir,
+        GIT_ALTERNATE_OBJECT_DIRECTORIES: fromRoot('.git/objects'),
+      },
+      timeout: 180_000,
     },
-    timeout: 180_000,
-  });
+  );
   plan.results.push(bundle);
   assertOk(bundle);
 
@@ -410,7 +459,11 @@ function createSourceBundle(args, plan) {
     indexFile: '.tmp/release.index',
     bundle: args.artifactDir.replaceAll('\\', '/') + `/audrey-${args.version}.git.bundle`,
   };
-  writeFileSync(fromRoot('.tmp/release-git-object-report.json'), `${JSON.stringify(objectReport, null, 2)}\n`, 'utf-8');
+  writeFileSync(
+    fromRoot('.tmp/release-git-object-report.json'),
+    `${JSON.stringify(objectReport, null, 2)}\n`,
+    'utf-8',
+  );
   plan.sourceControl = objectReport;
 }
 
@@ -434,18 +487,22 @@ function execute(args, plan) {
   }
 
   if (args.push) {
-    const push = run('git', [
-      '-c',
-      'http.sslBackend=openssl',
-      '-c',
-      'credential.helper=',
-      '-c',
-      'core.askPass=',
-      'push',
-      'origin',
-      'HEAD:master',
-      '--follow-tags',
-    ], { timeout: 45_000 });
+    const push = run(
+      'git',
+      [
+        '-c',
+        'http.sslBackend=openssl',
+        '-c',
+        'credential.helper=',
+        '-c',
+        'core.askPass=',
+        'push',
+        'origin',
+        'HEAD:master',
+        '--follow-tags',
+      ],
+      { timeout: 45_000 },
+    );
     plan.results.push(push);
     assertOk(push);
   }
@@ -464,7 +521,14 @@ function execute(args, plan) {
     const whoami = run('npm', ['whoami', '--registry', NPM_REGISTRY]);
     plan.results.push(whoami);
     assertOk(whoami);
-    const publishArgs = ['publish', npmTarballPath(args.artifactDir, args.version), '--access', 'public', '--registry', NPM_REGISTRY];
+    const publishArgs = [
+      'publish',
+      npmTarballPath(args.artifactDir, args.version),
+      '--access',
+      'public',
+      '--registry',
+      NPM_REGISTRY,
+    ];
     if (args.npmOtp) publishArgs.push('--otp', args.npmOtp);
     const publish = run('npm', publishArgs, { timeout: 180_000 });
     plan.results.push(publish);
@@ -473,19 +537,29 @@ function execute(args, plan) {
 
   if (args.publishPypi) {
     const uploadEnv = pypiCredentialEnv();
-    if (!uploadEnv) throw new Error('Missing PyPI credentials: set TWINE_PASSWORD, PYPI_API_TOKEN, or UV_PUBLISH_TOKEN');
+    if (!uploadEnv)
+      throw new Error(
+        'Missing PyPI credentials: set TWINE_PASSWORD, PYPI_API_TOKEN, or UV_PUBLISH_TOKEN',
+      );
     const build = run('npm', ['run', 'python:release:check'], { timeout: 180_000 });
     plan.results.push(build);
     assertOk(build);
     const artifacts = pythonArtifactPaths(args.version);
     if (artifacts.length === 0) throw new Error(`No Python artifacts found for ${args.version}`);
-    const upload = run('python', ['-m', 'twine', 'upload', ...artifacts], { timeout: 180_000, env: uploadEnv });
+    const upload = run('python', ['-m', 'twine', 'upload', ...artifacts], {
+      timeout: 180_000,
+      env: uploadEnv,
+    });
     plan.results.push(upload);
     assertOk(upload);
   }
 
   plan.artifacts = listArtifacts(artifactDir, args.version);
-  writeFileSync(join(artifactDir, 'release-finalize-report.json'), `${JSON.stringify(plan, null, 2)}\n`, 'utf-8');
+  writeFileSync(
+    join(artifactDir, 'release-finalize-report.json'),
+    `${JSON.stringify(plan, null, 2)}\n`,
+    'utf-8',
+  );
 }
 
 function printPlan(plan, json) {
@@ -503,7 +577,8 @@ function printPlan(plan, json) {
   }
   if (plan.artifacts.length) {
     console.log('Artifacts:');
-    for (const artifact of plan.artifacts) console.log(`- ${artifact.path} sha256=${artifact.sha256}`);
+    for (const artifact of plan.artifacts)
+      console.log(`- ${artifact.path} sha256=${artifact.sha256}`);
   }
 }
 

package/scripts/prepare-release-cut.mjs

@@ -4,7 +4,8 @@ import { fileURLToPath } from 'node:url';
 
 const ROOT = process.cwd();
 const DEFAULT_TARGET_VERSION = '1.0.0';
-const VERSION_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const VERSION_RE =
+  /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 
 function fromRoot(path) {
   return resolve(ROOT, path);
@@ -34,7 +35,8 @@ function parseArgs(argv = process.argv.slice(2)) {
 
   for (let i = 0; i < argv.length; i++) {
     const token = argv[i];
-    if ((token === '--target-version' || token === '--version') && argv[i + 1]) args.targetVersion = argv[++i];
+    if ((token === '--target-version' || token === '--version') && argv[i + 1])
+      args.targetVersion = argv[++i];
     else if (token === '--date' && argv[i + 1]) args.date = argv[++i];
     else if (token === '--apply') args.apply = true;
     else if (token === '--json') args.json = true;
@@ -203,10 +205,14 @@ export function prepareReleaseCut(options = {}) {
   const versions = currentVersionSnapshot();
   const versionValues = Object.values(versions);
   const failures = [];
-  if (versionValues.some(value => !value)) failures.push('One or more release version surfaces are missing');
-  if (new Set(versionValues).size !== 1) failures.push(`Release version surfaces are not aligned: ${JSON.stringify(versions)}`);
+  if (versionValues.some(value => !value))
+    failures.push('One or more release version surfaces are missing');
+  if (new Set(versionValues).size !== 1)
+    failures.push(`Release version surfaces are not aligned: ${JSON.stringify(versions)}`);
   if (versions.packageJson && compareCoreVersions(targetVersion, versions.packageJson) < 0) {
-    failures.push(`Target version ${targetVersion} is lower than current package version ${versions.packageJson}`);
+    failures.push(
+      `Target version ${targetVersion} is lower than current package version ${versions.packageJson}`,
+    );
   }
 
   const files = plannedFiles(targetVersion, date).map(([path, after]) => {
@@ -251,7 +257,9 @@ async function main() {
     console.log(JSON.stringify(report, null, 2));
   } else if (report.ok) {
     const changed = report.files.filter(file => file.changed).map(file => file.path);
-    console.log(`${report.apply ? 'Applied' : 'Planned'} Audrey ${report.targetVersion} release cut: ${changed.length} file(s)`);
+    console.log(
+      `${report.apply ? 'Applied' : 'Planned'} Audrey ${report.targetVersion} release cut: ${changed.length} file(s)`,
+    );
     for (const file of changed) console.log(`- ${file}`);
   } else {
     console.error('Release cut preparation failed:');

package/scripts/publish-release-bundle.mjs

@@ -22,7 +22,8 @@ function parseArgs(argv = process.argv.slice(2)) {
 
   for (let i = 0; i < argv.length; i++) {
     const token = argv[i];
-    if ((token === '--version' || token === '--target-version') && argv[i + 1]) args.version = argv[++i];
+    if ((token === '--version' || token === '--target-version') && argv[i + 1])
+      args.version = argv[++i];
     else if (token === '--bundle' && argv[i + 1]) args.bundle = argv[++i];
     else if (token === '--remote' && argv[i + 1]) args.remote = argv[++i];
     else if (token === '--apply') args.apply = true;
@@ -72,7 +73,12 @@ function run(command, args, options = {}) {
 }
 
 function firstLine(result) {
-  return `${result.stderr}\n${result.stdout}`.split(/\r?\n/).map(line => line.trim()).find(Boolean) ?? '';
+  return (
+    `${result.stderr}\n${result.stdout}`
+      .split(/\r?\n/)
+      .map(line => line.trim())
+      .find(Boolean) ?? ''
+  );
 }
 
 function parseBundleRefs(output, version) {
@@ -101,9 +107,27 @@ function parseRemoteRefs(output, version) {
 }
 
 function remoteHead(args) {
-  let result = run('git', ['ls-remote', args.remote, 'refs/heads/master', `refs/tags/v${args.version}`], { timeout: 60_000 });
-  if (!result.ok && /schannel|AcquireCredentialsHandle|SEC_E_NO_CREDENTIALS/i.test(firstLine(result))) {
-    result = run('git', ['-c', 'http.sslBackend=openssl', 'ls-remote', args.remote, 'refs/heads/master', `refs/tags/v${args.version}`], { timeout: 60_000 });
+  let result = run(
+    'git',
+    ['ls-remote', args.remote, 'refs/heads/master', `refs/tags/v${args.version}`],
+    { timeout: 60_000 },
+  );
+  if (
+    !result.ok &&
+    /schannel|AcquireCredentialsHandle|SEC_E_NO_CREDENTIALS/i.test(firstLine(result))
+  ) {
+    result = run(
+      'git',
+      [
+        '-c',
+        'http.sslBackend=openssl',
+        'ls-remote',
+        args.remote,
+        'refs/heads/master',
+        `refs/tags/v${args.version}`,
+      ],
+      { timeout: 60_000 },
+    );
     result.fallback = 'openssl';
   }
   return result;
@@ -112,20 +136,26 @@ function remoteHead(args) {
 function publishFromBundle(args, refs) {
   const temp = mkdtempSync(join(tmpdir(), 'audrey-release-push-'));
   try {
-    const clone = run('git', ['clone', '--bare', resolve(ROOT, args.bundle), temp], { timeout: 120_000 });
+    const clone = run('git', ['clone', '--bare', resolve(ROOT, args.bundle), temp], {
+      timeout: 120_000,
+    });
     if (!clone.ok) return [clone];
-    const push = run('git', [
-      '-c',
-      'http.sslBackend=openssl',
-      '-c',
-      'credential.helper=',
-      '-c',
-      'core.askPass=',
-      'push',
-      args.remote,
-      `${refs.master}:refs/heads/master`,
-      `${refs.tag}:refs/tags/v${args.version}`,
-    ], { cwd: temp, timeout: 45_000 });
+    const push = run(
+      'git',
+      [
+        '-c',
+        'http.sslBackend=openssl',
+        '-c',
+        'credential.helper=',
+        '-c',
+        'core.askPass=',
+        'push',
+        args.remote,
+        `${refs.master}:refs/heads/master`,
+        `${refs.tag}:refs/tags/v${args.version}`,
+      ],
+      { cwd: temp, timeout: 45_000 },
+    );
     return [clone, push];
   } finally {
     rmSync(temp, { recursive: true, force: true });
@@ -135,16 +165,22 @@ function publishFromBundle(args, refs) {
 export function planPublish(args) {
   const verify = run('git', ['bundle', 'verify', args.bundle], { timeout: 60_000 });
   const remote = remoteHead(args);
-  const bundleRefs = verify.ok ? parseBundleRefs(verify.stdout, args.version) : { master: null, tag: null };
-  const remoteRefs = remote.ok ? parseRemoteRefs(remote.stdout, args.version) : { master: null, tag: null };
+  const bundleRefs = verify.ok
+    ? parseBundleRefs(verify.stdout, args.version)
+    : { master: null, tag: null };
+  const remoteRefs = remote.ok
+    ? parseRemoteRefs(remote.stdout, args.version)
+    : { master: null, tag: null };
   const blockers = [];
 
   if (!verify.ok) blockers.push(`Bundle verification failed: ${firstLine(verify)}`);
   if (!bundleRefs.master) blockers.push('Bundle is missing refs/heads/master');
   if (!bundleRefs.tag) blockers.push(`Bundle is missing refs/tags/v${args.version}`);
   if (!remote.ok) blockers.push(`Remote check failed: ${firstLine(remote)}`);
-  if (remoteRefs.tag && remoteRefs.tag !== bundleRefs.tag) blockers.push(`Remote v${args.version} already points at ${remoteRefs.tag}`);
-  if (remoteRefs.master === bundleRefs.master && remoteRefs.tag === bundleRefs.tag) blockers.push('Remote already matches the release bundle');
+  if (remoteRefs.tag && remoteRefs.tag !== bundleRefs.tag)
+    blockers.push(`Remote v${args.version} already points at ${remoteRefs.tag}`);
+  if (remoteRefs.master === bundleRefs.master && remoteRefs.tag === bundleRefs.tag)
+    blockers.push('Remote already matches the release bundle');
 
   return {
     schemaVersion: '1.0.0',
@@ -198,7 +234,10 @@ async function main() {
 }
 
 function isDirectRun() {
-  return Boolean(process.argv[1]) && resolve(process.argv[1]).toLowerCase() === fileURLToPath(import.meta.url).toLowerCase();
+  return (
+    Boolean(process.argv[1]) &&
+    resolve(process.argv[1]).toLowerCase() === fileURLToPath(import.meta.url).toLowerCase()
+  );
 }
 
 if (isDirectRun()) {

package/scripts/publish-release-github-api.mjs

@@ -27,11 +27,14 @@ function parseArgs(argv = process.argv.slice(2)) {
 
   for (let i = 0; i < argv.length; i++) {
     const token = argv[i];
-    if ((token === '--repository' || token === '--repo') && argv[i + 1]) args.repository = argv[++i];
+    if ((token === '--repository' || token === '--repo') && argv[i + 1])
+      args.repository = argv[++i];
     else if (token === '--branch' && argv[i + 1]) args.branch = argv[++i];
-    else if ((token === '--version' || token === '--target-version') && argv[i + 1]) args.version = argv[++i];
+    else if ((token === '--version' || token === '--target-version') && argv[i + 1])
+      args.version = argv[++i];
     else if (token === '--token-env' && argv[i + 1]) args.tokenEnv = argv[++i];
-    else if (token === '--concurrency' && argv[i + 1]) args.concurrency = Number.parseInt(argv[++i], 10);
+    else if (token === '--concurrency' && argv[i + 1])
+      args.concurrency = Number.parseInt(argv[++i], 10);
     else if (token === '--apply') args.apply = true;
     else if (token === '--json') args.json = true;
     else if (token === '--force') args.force = true;
@@ -84,7 +87,10 @@ function run(command, args, options = {}) {
 }
 
 function assertOk(result) {
-  if (!result.ok) throw new Error(`${result.command} failed: ${result.stderr || result.stdout || result.error || result.status}`);
+  if (!result.ok)
+    throw new Error(
+      `${result.command} failed: ${result.stderr || result.stdout || result.error || result.status}`,
+    );
   return result.stdout;
 }
 
@@ -97,7 +103,9 @@ function normalized(path) {
 }
 
 function sha256(path) {
-  return createHash('sha256').update(readFileSync(resolve(ROOT, path))).digest('hex');
+  return createHash('sha256')
+    .update(readFileSync(resolve(ROOT, path)))
+    .digest('hex');
 }
 
 function readJsonIfExists(path) {
@@ -106,9 +114,24 @@ function readJsonIfExists(path) {
 }
 
 function collectChangedPaths() {
-  const changed = splitZ(assertOk(run('git', ['-c', 'core.quotepath=false', 'diff', '--name-only', '-z', 'HEAD', '--'])));
-  const untracked = splitZ(assertOk(run('git', ['-c', 'core.quotepath=false', 'ls-files', '--others', '--exclude-standard', '-z'])));
-  return [...new Set([...changed, ...untracked].map(normalized))].sort((a, b) => a.localeCompare(b));
+  const changed = splitZ(
+    assertOk(run('git', ['-c', 'core.quotepath=false', 'diff', '--name-only', '-z', 'HEAD', '--'])),
+  );
+  const untracked = splitZ(
+    assertOk(
+      run('git', [
+        '-c',
+        'core.quotepath=false',
+        'ls-files',
+        '--others',
+        '--exclude-standard',
+        '-z',
+      ]),
+    ),
+  );
+  return [...new Set([...changed, ...untracked].map(normalized))].sort((a, b) =>
+    a.localeCompare(b),
+  );
 }
 
 function fileMode(path) {
@@ -136,9 +159,34 @@ function changedEntries() {
 }
 
 function remoteRefs(repository, branch, version) {
-  let result = run('git', ['ls-remote', `https://github.com/${repository}.git`, `refs/heads/${branch}`, `refs/tags/v${version}`], { timeout: 60_000 });
-  if (!result.ok && /schannel|AcquireCredentialsHandle|SEC_E_NO_CREDENTIALS/i.test(`${result.stderr}\n${result.stdout}`)) {
-    result = run('git', ['-c', 'http.sslBackend=openssl', 'ls-remote', `https://github.com/${repository}.git`, `refs/heads/${branch}`, `refs/tags/v${version}`], { timeout: 60_000 });
+  let result = run(
+    'git',
+    [
+      'ls-remote',
+      `https://github.com/${repository}.git`,
+      `refs/heads/${branch}`,
+      `refs/tags/v${version}`,
+    ],
+    { timeout: 60_000 },
+  );
+  if (
+    !result.ok &&
+    /schannel|AcquireCredentialsHandle|SEC_E_NO_CREDENTIALS/i.test(
+      `${result.stderr}\n${result.stdout}`,
+    )
+  ) {
+    result = run(
+      'git',
+      [
+        '-c',
+        'http.sslBackend=openssl',
+        'ls-remote',
+        `https://github.com/${repository}.git`,
+        `refs/heads/${branch}`,
+        `refs/tags/v${version}`,
+      ],
+      { timeout: 60_000 },
+    );
     result.fallback = 'openssl';
   }
 
@@ -155,7 +203,10 @@ function remoteRefs(repository, branch, version) {
 }
 
 function releaseDates() {
-  const headTime = Number.parseInt(assertOk(run('git', ['show', '-s', '--format=%ct', 'HEAD'])), 10);
+  const headTime = Number.parseInt(
+    assertOk(run('git', ['show', '-s', '--format=%ct', 'HEAD'])),
+    10,
+  );
   const commitEpoch = headTime + 1;
   return {
     commitEpoch,
@@ -191,7 +242,9 @@ async function githubJson(token, repository, path, options = {}) {
   const payload = text ? JSON.parse(text) : null;
   if (!response.ok) {
     const message = payload?.message ?? text.slice(0, 500) ?? response.statusText;
-    throw new Error(`GitHub API ${options.method ?? 'GET'} ${path} failed (${response.status}): ${message}`);
+    throw new Error(
+      `GitHub API ${options.method ?? 'GET'} ${path} failed (${response.status}): ${message}`,
+    );
   }
   return payload;
 }
@@ -238,12 +291,18 @@ function localState(args) {
   const bytes = entries.reduce((total, entry) => total + entry.bytes, 0);
   const blockers = [];
 
-  if (!refs.result.ok) blockers.push(`Remote ref check failed: ${refs.result.stderr || refs.result.stdout || refs.result.error}`);
+  if (!refs.result.ok)
+    blockers.push(
+      `Remote ref check failed: ${refs.result.stderr || refs.result.stdout || refs.result.error}`,
+    );
   if (refs.branch && refs.branch !== localHead && !args.force) {
     blockers.push(`Remote ${args.branch} is ${refs.branch}, but local HEAD is ${localHead}`);
   }
   if (refs.tag) blockers.push(`Remote tag v${args.version} already exists at ${refs.tag}`);
-  if (!objectReport?.commit || !objectReport?.tree) blockers.push('Missing .tmp/release-git-object-report.json; run npm run release:artifacts first');
+  if (!objectReport?.commit || !objectReport?.tree)
+    blockers.push(
+      'Missing .tmp/release-git-object-report.json; run npm run release:artifacts first',
+    );
 
   return {
     localHead,
@@ -283,7 +342,9 @@ async function publishWithGitHubApi(args, state, token) {
   });
 
   if (state.expectedReleaseTree && tree.sha !== state.expectedReleaseTree) {
-    throw new Error(`GitHub release tree ${tree.sha} does not match local source-bundle tree ${state.expectedReleaseTree}`);
+    throw new Error(
+      `GitHub release tree ${tree.sha} does not match local source-bundle tree ${state.expectedReleaseTree}`,
+    );
   }
 
   const dates = releaseDates();
@@ -300,7 +361,9 @@ async function publishWithGitHubApi(args, state, token) {
   });
 
   if (state.expectedReleaseCommit && commit.sha !== state.expectedReleaseCommit) {
-    throw new Error(`GitHub release commit ${commit.sha} does not match local source-bundle commit ${state.expectedReleaseCommit}`);
+    throw new Error(
+      `GitHub release commit ${commit.sha} does not match local source-bundle commit ${state.expectedReleaseCommit}`,
+    );
   }
 
   const branchUpdate = await githubJson(token, args.repository, `/git/refs/heads/${args.branch}`, {
@@ -398,12 +461,12 @@ async function main() {
     })),
     changedEntries: args.includeEntries
       ? state.entries.map(entry => ({
-        path: entry.path,
-        deleted: entry.deleted,
-        mode: entry.mode,
-        bytes: entry.bytes,
-        sha256: entry.sha256,
-      }))
+          path: entry.path,
+          deleted: entry.deleted,
+          mode: entry.mode,
+          bytes: entry.bytes,
+          sha256: entry.sha256,
+        }))
       : undefined,
     finalizeArtifacts: state.finalizeArtifacts,
     blockers: [...state.blockers],
@@ -413,7 +476,9 @@ async function main() {
   if (args.apply) {
     const token = process.env[args.tokenEnv];
     if (!token) {
-      report.blockers.push(`Set ${args.tokenEnv} to a GitHub token with contents:write before applying`);
+      report.blockers.push(
+        `Set ${args.tokenEnv} to a GitHub token with contents:write before applying`,
+      );
     } else if (report.blockers.length === 0) {
       report.publish = await publishWithGitHubApi(args, state, token);
     }

package/scripts/smoke-cli.js

@@ -24,11 +24,9 @@ if (!existsSync(cli)) {
 }
 
 function createTempRoot() {
-  const candidates = [
-    process.env.AUDREY_SMOKE_TMPDIR,
-    tmpdir(),
-    join(root, '.tmp'),
-  ].filter(Boolean);
+  const candidates = [process.env.AUDREY_SMOKE_TMPDIR, tmpdir(), join(root, '.tmp')].filter(
+    Boolean,
+  );
   const failures = [];
 
   for (const candidate of candidates) {
@@ -75,10 +73,12 @@ try {
 
   const doctor = JSON.parse(run('doctor --json', ['doctor', '--json']));
   if (doctor.version !== pkg.version || doctor.ok !== true) {
-    fail(`doctor --json returned unexpected release status: ${JSON.stringify({
-      version: doctor.version,
-      ok: doctor.ok,
-    })}`);
+    fail(
+      `doctor --json returned unexpected release status: ${JSON.stringify({
+        version: doctor.version,
+        ok: doctor.ok,
+      })}`,
+    );
   }
 
   const demo = run('demo', ['demo']);